CVE-2022-26969: Critical severity monospace directus vulnerability
Impact
The default value for the CORSENABLED and CORSORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.
Patches
The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0
Workarounds
Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.
For more information If you have any questions or comments about this advisory: Open an issue in directus/directus Email us at security@directus.io
Other sources
In Directus before 9.7.0, the default settings of CORSORIGIN and CORSENABLED are true.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-26969.
What is the severity of CVE-2022-26969?
The severity of CVE-2022-26969 is critical with a CVSS score of 9.8.
What is Directus?
Directus is a headless CMS (Content Management System) framework.
What are the default settings of CORS_ORIGIN and CORS_ENABLED in Directus before version 9.7.0?
The default settings of CORS_ORIGIN and CORS_ENABLED are true in Directus before version 9.7.0.
How can I fix the vulnerability in Directus?
To fix the vulnerability, upgrade to Directus version 9.7.0 or higher.