CVE-2024-39701
- Source
- https://cve.org/CVERecord?id=CVE-2024-39701
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39701.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-39701
- Aliases
- Published
- 2024-07-08T16:43:01.595Z
- Modified
- 2026-03-14T12:35:03.143883Z
- Severity
-
- 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- Directus Incorrectly handles _in` filter
- Details
-
Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, nin operators. It evaluates empty arrays as valid so expressions like {"role": {"in": $CURRENTUSER.somefield}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do: Pass rule if field matches any of the values. This vulnerability is fixed in 10.6.0.
- Database specific
{ "cwe_ids": [ "CWE-284" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39701.json", "cna_assigner": "GitHub_M" }- References