CVE-2019-13981: Medium severity rangerstudio directus 7 api vulnerability
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads//originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13981?
CVE-2019-13981 is considered to be of medium severity due to the potential for unauthorized access to sensitive image files.
How can I fix CVE-2019-13981?
To fix CVE-2019-13981, ensure that the file collection configuration aligns with accessibility requirements and review user permissions carefully.
What software versions are affected by CVE-2019-13981?
CVE-2019-13981 affects Directus 7 API versions up to and including 2.3.0.
What type of attacks does CVE-2019-13981 allow?
CVE-2019-13981 allows remote attackers to read image files by directly requesting filenames within the uploads/_/originals/ directory.
Is there a way to make files in the affected directory private in CVE-2019-13981?
The configuration option to make the file collection non-public does not apply to the thumbnailer, so this distinction should be reviewed in your setup.