MEDIUM5.3

GHSA-5mhg-wv8w-p59j

Directus version number disclosure

Quick fix

GHSA-5mhg-wv8w-p59j — directus: upgrade to the fixed version with the command below.

npm install directus@10.8.3

Details

### Impact

Currently the exact Directus version number is being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version.

### Patches

The problem has been resolved in versions 10.8.3 and newer

### Workarounds

None

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/directus

Introduced in: 0Fixed in: 10.8.3

Fixnpm install directus@10.8.3

References

https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2024-27296[ADVISORY]
https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0[WEB]
https://github.com/directus/directus[PACKAGE]