high7.5
CVE-2023-27474
directus vulnerable to HTML Injection in Password Reset email to custom Reset URL
Impact
### Impact Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. ### Patches The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or later, or remove the custom reset url from the configured allow list. ### Workarounds Disable the custom reset URL allow list.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | directus | < 9.23.0 | 9.23.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rangerstudio | Directus | before 9.23.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/directus/directus/issues/17119
- https://github.com/directus/directus/pull/17120
- https://github.com/directus/directus/security/advisories/GHSA-4hmq-ggrm-qfc6
- https://github.com/advisories/GHSA-4hmq-ggrm-qfc6
- https://nvd.nist.gov/vuln/detail/CVE-2023-27474