CVE-2024-36128 json
Directus is soft-locked by providing a string value to random string util
published 2024-06-03 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1938 , GHSA-632p-p495-25m5
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | directus | <10.11.2 |
10.11.2 |
Affected products
- directus directus
- monospace directus
Classification
- Weakness
-
- CWE-754 Improper Check for Unusual or Exceptional Conditions
References
-
github.com
/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b
web, patch
-
github.com
/directus/directus/security/advisories/GHSA-632p-p495-25m5
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-36128
advisory
-
github.com
/directus/directus
package
Sources
- CVE List CVE-2024-36128
- GitHub Advisory GHSA-632p-p495-25m5
- NVD CVE-2024-36128
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.