{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-04T07:53:34.863","vulnerabilities":[{"cve":{"id":"CVE-2025-30353","sourceIdentifier":"security-advisories@github.com","published":"2025-03-26T18:15:27.327","lastModified":"2026-06-17T09:08:34.137","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the \"Webhook\" trigger and the \"Data of Last Operation\" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue."},{"lang":"es","value":"Directus es un panel de control de API y aplicaciones en tiempo real para gestionar el contenido de bases de datos SQL. A partir de la versión 9.12.0 y anteriores a la 11.5.0, cuando un flujo con el disparador \"Webhook\" y el cuerpo de respuesta \"Datos de la última operación\" encuentra un error de validación generado por una operación condicional fallida, la respuesta de la API incluye datos confidenciales. Estos incluyen variables de entorno, claves de API confidenciales, información de responsabilidad del usuario y datos operativos. Este problema supone un riesgo de seguridad significativo, ya que cualquier exposición involuntaria de estos datos podría dar lugar a un posible uso indebido. La versión 11.5.0 soluciona el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"directus","product":"directus","versions":[{"version":">= 9.12.0, < 11.5.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-26T17:43:59.404279Z","id":"CVE-2025-30353","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*","versionStartIncluding":"9.12.0","versionEndExcluding":"11.5.0","matchCriteriaId":"F6E0D59B-7EE8-4275-BE4F-10D92F7D51EC"}]}]}],"references":[{"url":"https://github.com/directus/directus/security/advisories/GHSA-fm3h-p9wm-h74h","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/directus/directus/security/advisories/GHSA-fm3h-p9wm-h74h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"]}]}}]}