CVE-2023-27481 json
Extract password hashes through export querying in directus
published 2023-03-07 3 y ago modified 2026-09-10 1 mo ago also GHSA-m5q3-8wgf-x8xf , EUVD-2023-1055
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the `password` field in `directus_users` can extract the argon2 password hashes by brute forcing the export functionality combined with a `_starts_with` filter. This allows the user to enumerate the password hashes. Accounts cannot be taken over unless the hashes can be reversed which is unlikely with current hardware. This problem has been patched by preventing any hashed/concealed field to be filtered against with the `_starts_with` or other string operator in version 9.16.0. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by ensuring that no user has `read` access to the `password` field in `directus_users`.
Patch / fix
- npm directus 9.16.0
- monospace directus 9.16.0
- github.com/directus/directus#14829 pull request
- github.com/directus/directus#15010 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | directus | <9.16.0 |
9.16.0 |
Affected products
- directus directus
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/directus/directus/pull/14829
web, patch, vendor-advisory
-
github.com
/directus/directus/pull/15010
web, patch, vendor-advisory
-
github.com
/directus/directus/security/advisories/GHSA-m5q3-8wgf-x8xf
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-27481
advisory
-
github.com
/directus/directus
package
Sources
- CVE List CVE-2023-27481
- GitHub Advisory GHSA-m5q3-8wgf-x8xf
- NVD CVE-2023-27481
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.