{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T20:24:53.165","vulnerabilities":[{"cve":{"id":"CVE-2024-45596","sourceIdentifier":"security-advisories@github.com","published":"2024-09-10T19:15:22.303","lastModified":"2026-06-17T07:54:32.363","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials. This vulnerability is fixed in 10.13.3 and 11.1.0."},{"lang":"es","value":"Directus es una API en tiempo real y un panel de control de aplicaciones para administrar el contenido de bases de datos SQL. Un usuario no autenticado puede acceder a las credenciales del último usuario autenticado a través de OpenID u OAuth2 donde la URL de autenticación no incluía una cadena de consulta de redireccionamiento. Esto sucede porque en ese endpoint, tanto para OpenID como para OAuth2, Directus usa el middleware de respuesta, que de manera predeterminada intentará almacenar en caché las solicitudes GET que cumplieron con algunas condiciones. Sin embargo, esas condiciones no incluyen este escenario, cuando una solicitud no autenticada devuelve las credenciales del usuario. Esta vulnerabilidad se corrigió en 10.13.3 y 11.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"directus","product":"directus","versions":[{"version":"< 10.13.3","status":"affected"},{"version":">= 11.0.0, < 11.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-09-10T19:20:20.595959Z","id":"CVE-2024-45596","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-524"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*","versionEndExcluding":"10.13.3","matchCriteriaId":"B761A4B2-2A24-4667-B697-60805666E109"},{"vulnerable":true,"criteria":"cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*","versionStartIncluding":"11.0.0","versionEndExcluding":"11.1.0","matchCriteriaId":"0249F0A8-ED9D-4C66-8EC1-B12210B5343B"}]}]}],"references":[{"url":"https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}