Skip to content
OpenAdvisories

Package · npm

@directus/api

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2024-54151

    Directus allows unauthenticated access to WebSocket events and operations

    Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of…

    directus directus directus @directus/api npm
  • High 7.4
    CVE-2024-45596

    Directus's session is cached for OpenID and OAuth2 if `redirect` is not used

    Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens be…

    directus directus directus @directus/api npm