Published: 23/02/2021 Updated: 23/02/2021

Vulnerability Summary

** UNSUPPORTED WHEN ASSIGNED ** In Directus 8.x up to and including 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information about the user (such as email address, first name, and last name) but also the secret for 2FA if one exists. This secret can be regenerated. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.

Vulnerability Trend

Github Repositories

Directus V8 This article aims to discuss about security issues found in CMS Directus in version 872 In a professional context, I process security audit against Web application running under CMS Directus From security best practices assessment, I found several flaws which can have a significant impact on overall security The audited platform is using php 74, mysql (VERSION