Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-27296
CVE-2024-27296:
JavaScript vulnerability analysis and mitigation
Overview
Directus, a real-time API and App dashboard for managing SQL database content, was found to have a version disclosure vulnerability in versions prior to 10.8.3. The vulnerability was discovered and disclosed on March 1, 2024, affecting all versions up to and including 10.8.2. The exact Directus version number was being shipped in compiled JS bundles which were accessible without authentication (GitHub Advisory).
Technical details
The vulnerability is tracked as CVE-2024-27296 with a CVSS v3.1 base score of 5.3 (Medium). The vulnerability is characterized by Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, Low confidentiality impact, and No impact on integrity or availability. The weakness is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).
Impact
The exposure of the exact version number allows malicious attackers to trivially identify known vulnerabilities in Directus core or any of its shipped dependencies for that specific running version. This information disclosure could potentially facilitate targeted attacks against vulnerable installations (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in Directus version 10.8.3 and newer versions. No workarounds are available for this vulnerability, making upgrading to a patched version the only solution (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management