Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-45820

Good to know:

icon

Date: October 19, 2023

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.

Language: JS

Severity Score

Related Resources (4)

https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m
https://nvd.nist.gov/vuln/detail/CVE-2023-45820
https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb
https://www.mend.io/vulnerability-database/CVE-2023-45820

Severity Score

Weakness Type (CWE)

Improper Handling of Exceptional Conditions

CWE-755

Top Fix

icon

Upgrade Version

Upgrade to version directus - 10.6.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us