CVE-2024-34709mediumCWE-613

CVE-2024-34709: falha de média gravidade em directus

Directus Lacks Session Tokens Invalidation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar directus+ Monitorar directus

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.4%
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry time which is set to 1 day by default. Making it effectively a long lived unrevokable stateless token instead of the stateful session token it was meant to be. This vulnerability is fixed in 10.11.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
Produtos afetados
directus · directus
CVEs relacionadas — directus

No mesmo produto, das mais perigosas para as menos.

CVE-2025-55746CRITICALDirectus allows unauthenticated file upload and file modification due to lacking input sanitizationEPSS 1.4%CVE-2022-24814HIGHCross-site Scripting in DirectusEPSS 1.0%CVE-2025-53887MEDIUMDirectus's exact version number is exposed by the OpenAPI SpecEPSS 1.0%CVE-2022-36031MEDIUMUnhandled exception on illegal filename_disk valueEPSS 1.0%CVE-2023-26492MEDIUMDirectus vulnerable to Server-Side Request Forgery On File ImportEPSS 1.0%CVE-2023-45820MEDIUMDirectus crashes on invalid WebSocket messageEPSS 0.8%