Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unhandled exception on illegal filename_disk value
Vulnerability Description
Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint. This vulnerability has been patched and release v9.15.0 contains the fix. Users are advised to upgrade. Users unable to upgrade may prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
对异常条件的处理不恰当
Vulnerability Title
Directus 安全漏洞
Vulnerability Description
Directus是一个实时 Api 和应用程序仪表板。用于管理 Sql 数据库内容。 Directus 存在安全漏洞，该漏洞源于攻击者通过授权用户将”filename_disk“值更新到一个文件夹，并通过”/assets“端点访问该文件，可以中止Directus进程。
CVSS Information
N/A
Vulnerability Type
N/A