medium5.3
CVE-2024-27296
Directus version number disclosure
Impact
### Impact Currently the exact Directus version number is being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. ### Patches The problem has been resolved in versions 10.8.3 and newer ### Workarounds None
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | directus | <= 10.8.2 | 10.8.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Monospace | Directus | before 10.8.3 |