TI-2024-32089 Aliases CVE-2024-47822 GHSA-vw58-ph65-6rxp

Directus inserts access token from query string into logs

MEDIUM 53CWE-532Published 2024-10-08 · Updated 2025-04-14

Key facts

Attack vector: Local
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the `LOG_STYLE` is set to `raw`. The `access_token` in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string. This vulnerability has been patched in release version 10.13.2 and subsequent releases as well. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00311 24th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed directus (directus): 10.13.2@directus/api (npm): 21.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
directus	directus	before 10.13.2	10.13.2	Patch available	CNA
—	@directus/api (npm)	before 21.0.0	21.0.0	Patch available	GHSA-vw58-ph65-6rxp

directus Vendordirectus Affected before 10.13.2 Fixed in 10.13.2 Patch available CNA
@directus/api (npm) Vendor— Affected before 21.0.0 Fixed in 21.0.0 Patch available GHSA-vw58-ph65-6rxp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:monospace:directus::::::node.js::*	before 10.13.2	Vulnerable	directus

cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:* Versions before 10.13.2 Vulnerable ·directus

Remediation

Fix · CNA directus (directus) Fixed in 10.13.2
Fix · GHSA-vw58-ph65-6rxp @directus/api (npm) Fixed in 21.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-47822
2026-10-03 Alias added: GHSA-vw58-ph65-6rxp

References

Exploit 1

https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-47822

Other 2

TI-2025-21659 Directus's webhook trigger flows can leak sensitive data CVSS 3.1HIGH 8.6
TI-2024-36266 Directus allows unauthenticated access to WebSocket events and operations CVSS 3.1HIGH 7.5
TI-2024-26791 Directus allows SSO User Enumeration CVSS 3.1HIGH 7.5
TI-2024-23956 Directus is soft-locked by providing a string value to random string util CVSS 3.1HIGH 7.5
TI-2024-26624 Directus Incorrectly handles _in` filter CVSS 3.1HIGH 7.7
TI-2025-21658 Directus `search` query parameter allows enumeration of non permitted fields CVSS 3.1MEDIUM 5.3

See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences