CVE-2023-45820 MEDIUM

CVE-2023-45820: Directus crashes on invalid WebSocket message

Vendor Directus
Product directus
Weakness CWE-755
Published October 19, 2023
Last update September 12, 2024
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.

Key dates

02Disclosure timeline

October 19, 2023 CVE published
September 12, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-39525 Junos OS and Junos OS Evolved: When BGP traceoptions is enabled, receipt of specially crafted BGP packet causes RPD crash CVE-2021-21592 CVE-2023-5090 Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs CVE-2025-48886 hydra-node dangerously assumes L1 event finality and does not consider failed transactions CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed