Description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| directus | directus | < 9.23.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | directus | < 9.23.3 | 9.23.3 | GHSA-8vg2-wf3q-mwv7 |