CVE-2021-26595: Medium severity directus 7 api vulnerability

Q: What is the severity of CVE-2021-26595?

CVE-2021-26595 is classified as an information disclosure vulnerability.

Q: How do I fix CVE-2021-26595?

To fix CVE-2021-26595, you should upgrade Directus to version 8.8.2 or later.

Q: What information can be leaked due to CVE-2021-26595?

CVE-2021-26595 can leak sensitive details including the CMS version, PHP version, and database management system name.

Q: Which versions of Directus are affected by CVE-2021-26595?

CVE-2021-26595 affects Directus versions from 8.0.0 to 8.8.1.

Q: Is CVE-2021-26595 related to security practices in Directus?

Yes, CVE-2021-26595 highlights the need for securing sensitive configuration information in Directus.

Published Feb 23, 2021

Updated

UNSUPPORTED WHEN ASSIGNED In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected Software

1 affected component

Rangerstudio Directus>=8.0.0<=8.8.1

Event History

Feb 23, 2021

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2021-26595?

CVE-2021-26595 is classified as an information disclosure vulnerability.

How do I fix CVE-2021-26595?

To fix CVE-2021-26595, you should upgrade Directus to version 8.8.2 or later.

What information can be leaked due to CVE-2021-26595?

CVE-2021-26595 can leak sensitive details including the CMS version, PHP version, and database management system name.

Which versions of Directus are affected by CVE-2021-26595?

CVE-2021-26595 affects Directus versions from 8.0.0 to 8.8.1.

Is CVE-2021-26595 related to security practices in Directus?