GHSA-rmjh-cf9q-pv7q

Suggest an improvement
Source
https://github.com/advisories/GHSA-rmjh-cf9q-pv7q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-rmjh-cf9q-pv7q/GHSA-rmjh-cf9q-pv7q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rmjh-cf9q-pv7q
Aliases
Published
2025-07-15T15:29:38Z
Modified
2025-07-15T16:12:14Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Directus' exact version number is exposed by the OpenAPI Spec
Details

Summary

The exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the /server/specs/oas endpoint without authentication.

Impact

With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version.

Database specific 
{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-07-15T15:29:38Z",
    "nvd_published_at":  "2025-07-15T00:15:23Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / directus

Package

Name
directus
View open source insights on deps.dev
Purl
pkg:npm/directus

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.9.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-rmjh-cf9q-pv7q/GHSA-rmjh-cf9q-pv7q.json"