CVE-2025-53885mediumCWE-532

CVE-2025-53885: falha de média gravidade em directus

Directus doesn't redact sensitive user data when logging via event hooks

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar directus+ Monitorar directus

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.2epss 0.2%
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template string. Malicious admins can log sensitive data from other users when they are created or updated. Version 11.9.0 contains a fix for the issue. As a workaround, avoid logging sensitive data to the console outside the context of development.
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
directus · directus
CVEs relacionadas — directus

No mesmo produto, das mais perigosas para as menos.

CVE-2025-55746CRITICALDirectus allows unauthenticated file upload and file modification due to lacking input sanitizationEPSS 1.4%CVE-2022-24814HIGHCross-site Scripting in DirectusEPSS 1.0%CVE-2025-53887MEDIUMDirectus's exact version number is exposed by the OpenAPI SpecEPSS 1.0%CVE-2022-36031MEDIUMUnhandled exception on illegal filename_disk valueEPSS 1.0%CVE-2023-26492MEDIUMDirectus vulnerable to Server-Side Request Forgery On File ImportEPSS 1.0%CVE-2023-45820MEDIUMDirectus crashes on invalid WebSocket messageEPSS 0.8%