CVE-2023-28443
directus vulnerable to Insertion of Sensitive Information into Log File
Résumé
directus vulnerable to Insertion of Sensitive Information into Log File
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the directus_refresh_token is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com