Description (CNA)
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts with geometry but contains attacker-controlled SQL syntax after the geometry subtype.This issue affects Directus: before 12.1.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Directus / Directus | affected 0 before 12.1.0 |
CWE
CWE-89
References
- https://fluidattacks.com/es/advisories/metallica
- https://github.com/directus/directus
- https://github.com/directus/directus/security/advisories/GHSA-chfm-g7r3-vv42
- https://github.com/directus/directus/releases#release-v12.1.0
ADP enrichment
No English description supplied.
No references supplied.