SB2023030762 - Information disclosure in Directus
Published: March 7, 2023 Updated: April 23, 2026
Security Bulletin ID
SB2023030762
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Information disclosure (CVE-ID: CVE-2023-27481)
The vulnerability allows a remote user to disclose password hashes.
The vulnerability exists due to exposure of sensitive information in the export functionality for the directus_users password field when combining export queries with a _starts_with filter. A remote privileged user can brute force export queries to disclose password hashes.
The issue affects users who have read access to the password field in directus_users.
Remediation
Install update from vendor's website.