CVE-2024-27295 json
Directus MySQL accent insensitive email matching
published 2024-03-01 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-0993 , GHSA-qw9g-7549-7wg5
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents. This is due to the fact that by default MySQL/MariaDB are configured for accent-insensitive and case-insensitive comparisons. This vulnerability is fixed in version 10.8.3.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/directus/directus/security/advisories/GHSA-qw9g-7549-7wg5 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | directus | <10.8.3 |
10.8.3 |
Affected products
- directus directus
Classification
- Weakness
-
- CWE-706 Use of Incorrectly-Resolved Name or Reference
References
-
github.com
/directus/directus/commit/a8ef790ea2d28b1727f9027d99bd360920d57919
web
-
github.com
/directus/directus/security/advisories/GHSA-qw9g-7549-7wg5
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-27295
advisory
-
dev.mysql.com
/doc/refman/8.0/en/charset-unicode-sets.html
web
-
github.com
/directus/directus
package
-
monolune.com
/articles/what-is-the-utf8mb4_0900_ai_ci-collation
web
Sources
- CVE List CVE-2024-27295
- GitHub Advisory GHSA-qw9g-7549-7wg5
- NVD CVE-2024-27295
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.