CVE-2024-46990 json
SSRF Loopback IP filter bypass in directus
published 2024-09-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2730 , GHSA-68g8-c275-xf2m
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.
Patch / fix
- npm directus 10.13.3, 11.1.0
- npm @directus/api 21.0.0, 22.1.1
- monospace directus 10.13.3, 11.1.0
- rangerstudio directus 10.13.3, 11.1.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| GitHub | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| NVD | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | directus | <10.13.3 >=11.0.0, <11.1.0 |
10.13.3 11.1.0 |
| npm | @directus/api | <21.0.0 >=22.0.0, <22.1.1 |
21.0.0 22.1.1 |
Affected products
- directus directus
Classification
References
-
github.com
/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b
web, patch
-
github.com
/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52
web, patch
-
github.com
/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff
web, patch
-
github.com
/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431
web, patch
-
github.com
/directus/directus/security/advisories/GHSA-68g8-c275-xf2m
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-46990
advisory
-
github.com
/directus/directus
package
Sources
- CVE List CVE-2024-46990
- GitHub Advisory GHSA-68g8-c275-xf2m
- NVD CVE-2024-46990
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.