CVE-2022-23080

high-risk

Published 2022-06-22

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.

Do I need to act?

0.09% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.0/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Directus

Affected Vendors

Rangerstudio

References (4)

Patch https://github.com/directus/directus/commit/6da3f1ed5034115b1da00440008351bf0d80...

Exploit https://www.mend.io/vulnerability-database/CVE-2022-23080

Patch https://github.com/directus/directus/commit/6da3f1ed5034115b1da00440008351bf0d80...

Exploit https://www.mend.io/vulnerability-database/CVE-2022-23080

/ 100

high-risk

Severity 20/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 31/34 · Critical