CVE-2024-46990

MEDIUM Year: 2024
CVSS v3 Score
5.0
Medium
Weakness Type
CWE-284
View all →

Vulnerability Description

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.

Related Vulnerabilities

CVE-2016-0318

MEDIUM
CVSS:5.0(Medium)

Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows remote attackers to obtain access by leve...

CWE-2842016

CVE-2016-5594

MEDIUM
CVSS:5.0(Medium)

Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, and 12.0.1 through 12.0.3 allows remote authenticated users to af...

CWE-2842016

CVE-2020-26077

MEDIUM
CVSS:5.0(Medium)

A vulnerability in the access control functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to view lists of users from different domains that are confi...

CWE-2842020

CVE-2023-26585

MEDIUM
CVSS:5.0(Medium)

Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial of service via local access.

CWE-2842023

CVE-2023-32063

MEDIUM
CVSS:5.0(Medium)

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to ins...

CWE-2842023

CVE-2024-11483

MEDIUM
CVSS:5.0(Medium)

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issu...

CWE-2842024