CVE-2023-28443: directus vulnerable to Insertion of Sensitive Information into Log File

Q: What is CVE-2023-28443?

CVE-2023-28443 is a vulnerability in Directus, a real-time API and App dashboard, that allows an attacker to impersonate users using an improperly redacted refresh token.

Q: What is the severity of CVE-2023-28443?

CVE-2023-28443 has a medium severity with a CVSS score of 5.5.

Q: How does CVE-2023-28443 affect Directus?

CVE-2023-28443 affects Directus versions prior to 9.23.3, where the directus_refresh_token is not properly redacted from log outputs.

Q: How can an attacker exploit CVE-2023-28443?

An attacker can exploit CVE-2023-28443 by using the unredacted directus_refresh_token in log outputs to impersonate users without their permission.

Q: How can I fix CVE-2023-28443?

You can fix CVE-2023-28443 by updating Directus to version 9.23.3 or later.

Published Mar 23, 2023

Updated

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the directusrefreshtoken is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.

Affected Software

1 affected component

Monospace Directus Node.js<9.23.3

Remediation

Patch Available

https://github.com/directus/directus/commit/349536303983ccba68ecb3e4fb35315424011afc

Event History

Mar 23, 2023

CVE Published

via MITRE·11:13 PM

Data Sourced

via MITRE·11:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-28443?

CVE-2023-28443 is a vulnerability in Directus, a real-time API and App dashboard, that allows an attacker to impersonate users using an improperly redacted refresh token.

What is the severity of CVE-2023-28443?

CVE-2023-28443 has a medium severity with a CVSS score of 5.5.

How does CVE-2023-28443 affect Directus?