high8.8
CVE-2019-13984
Directus 7 API before 2.3.0 does not validate uploaded files.
Impact
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rangerstudio | Directus 7 Api | before 2.3.0 |