CVE-2024-45596

Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials. This vulnerability is fixed in 10.13.3 and 11.1.0.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b	Patch
https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52	Patch
https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:monospace:directus::::::node.js::*
	cpe:2.3:a:monospace:directus::::::node.js::*

History

17 Nov 2025, 18:42

Type	Values Removed	Values Added
First Time		Monospace Monospace directus
CPE		cpe:2.3:a:monospace:directus::::::node.js::*
References	~~() https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b -~~	() https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b - Patch
References	~~() https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52 -~~	() https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52 - Patch
References	~~() https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8 -~~	() https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8 - Exploit, Vendor Advisory

Information

Published : 2024-09-10 19:15

Updated : 2025-11-17 18:42

NVD link : CVE-2024-45596

Mitre link : CVE-2024-45596

CVE.ORG link : CVE-2024-45596

JSON object : View

Products Affected

monospace

directus

CWE

CWE-524

Use of Cache Containing Sensitive Information

{"id": "CVE-2024-45596", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-09-10T19:15:22.303", "references": [{"url": "https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-524"}]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials. This vulnerability is fixed in 10.13.3 and 11.1.0."}, {"lang": "es", "value": "Directus es una API en tiempo real y un panel de control de aplicaciones para administrar el contenido de bases de datos SQL. Un usuario no autenticado puede acceder a las credenciales del \u00faltimo usuario autenticado a trav\u00e9s de OpenID u OAuth2 donde la URL de autenticaci\u00f3n no inclu\u00eda una cadena de consulta de redireccionamiento. Esto sucede porque en ese endpoint, tanto para OpenID como para OAuth2, Directus usa el middleware de respuesta, que de manera predeterminada intentar\u00e1 almacenar en cach\u00e9 las solicitudes GET que cumplieron con algunas condiciones. Sin embargo, esas condiciones no incluyen este escenario, cuando una solicitud no autenticada devuelve las credenciales del usuario. Esta vulnerabilidad se corrigi\u00f3 en 10.13.3 y 11.1.0."}], "lastModified": "2025-11-17T18:42:18.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B761A4B2-2A24-4667-B697-60805666E109", "versionEndExcluding": "10.13.3"}, {"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0249F0A8-ED9D-4C66-8EC1-B12210B5343B", "versionEndExcluding": "11.1.0", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}