CVE-2023-28443 MEDIUM

CVE-2023-28443: directus vulnerable to Insertion of Sensitive Information into Log File

Vendor Directus

Product directus

Weakness CWE-532 · Sensitive info in logs

Published March 23, 2023

Last update February 21, 2025

View on NVD All CVEs

CVSS base score

4.2/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.

Key dates

02Disclosure timeline

March 23, 2023 CVE published

February 21, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-28443 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/532.html

Related vulnerabilities

04Related CVE

CVE-2024-25095 WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerability CVE-2024-29955 Insertion of Sensitive Information into Brocade SANnav Log File CVE-2024-31259 WordPress SearchIQ plugin <= 4.5 - Sensitive Data Exposure via Log File vulnerability CVE-2024-42196 HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability CVE-2020-11646 GateManager Log Information Disclosure Vulnerability