CVE-2023-28443

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.

Score

CVSS 3.1 5.5 Medium

Status

Modified - security-advisories@github.com

Published

2023-03-24

Last modified

2025-02-21

Weaknesses

CWE-284, CWE-532

Affected products

• Directus (Directus)
• Directus (Monospace)

References

• https://github.com/directus/directus/blob/7c479c5161639aac466c763b6b958a9524201d74/api/src/logger.ts#L13
• https://github.com/directus/directus/commit/349536303983ccba68ecb3e4fb35315424011afc
• https://github.com/directus/directus/security/advisories/GHSA-8vg2-wf3q-mwv7