CVE-2022-23080
directus - SSRF which leads to internal port scan
MEDIUM
5
CVSS Score
Published: June 22, 2022 at 03:40 PM UTC
Updated: June 17, 2026 at 04:29 AM UTC
2 products affected across 2 vendorsDirectusDirectus
Using directus by directus?
Get instant alerts when new vulnerabilities affect directus - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5
Exploit prediction
EPSS 0.8%
Description
In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Directus· Rangerstudiocontainer
95%9.0.1 ≤ v ≤ 9.6.09.0.0 beta109.0.0 beta119.0.0 beta129.0.0 beta139.0.0 beta149.0.0 beta29.0.0 beta39.0.0 beta49.0.0 beta59.0.0 beta79.0.0 beta89.0.0 beta99.0.0 rc09.0.0 rc19.0.0 rc109.0.0 rc1009.0.0 rc1019.0.0 rc119.0.0 rc129.0.0 rc139.0.0 rc149.0.0 rc159.0.0 rc179.0.0 rc189.0.0 rc199.0.0 rc29.0.0 rc209.0.0 rc219.0.0 rc229.0.0 rc239.0.0 rc249.0.0 rc259.0.0 rc269.0.0 rc279.0.0 rc289.0.0 rc299.0.0 rc39.0.0 rc309.0.0 rc319.0.0 rc329.0.0 rc339.0.0 rc349.0.0 rc359.0.0 rc369.0.0 rc379.0.0 rc389.0.0 rc399.0.0 rc49.0.0 rc409.0.0 rc419.0.0 rc429.0.0 rc439.0.0 rc449.0.0 rc459.0.0 rc469.0.0 rc479.0.0 rc489.0.0 rc499.0.0 rc59.0.0 rc509.0.0 rc519.0.0 rc529.0.0 rc539.0.0 rc549.0.0 rc559.0.0 rc569.0.0 rc579.0.0 rc589.0.0 rc599.0.0 rc69.0.0 rc609.0.0 rc619.0.0 rc629.0.0 rc639.0.0 rc649.0.0 rc659.0.0 rc669.0.0 rc679.0.0 rc689.0.0 rc699.0.0 rc79.0.0 rc709.0.0 rc719.0.0 rc729.0.0 rc739.0.0 rc749.0.0 rc759.0.0 rc769.0.0 rc779.0.0 rc789.0.0 rc799.0.0 rc89.0.0 rc809.0.0 rc819.0.0 rc829.0.0 rc839.0.0 rc849.0.0 rc859.0.0 rc869.0.0 rc879.0.0 rc889.0.0 rc899.0.0 rc99.0.0 rc909.0.0 rc919.0.0 rc929.0.0 rc939.0.0 rc949.0.0 rc959.0.0 rc969.0.0 rc979.0.0 rc989.0.0 rc99
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (2)
x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/directus/directus/commit/6da3f1ed5034115b1da00440008351bf0d808d83x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://www.mend.io/vulnerability-database/CVE-2022-23080CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- CHANGED
- Confidentiality
- LOW
- Integrity
- NONE
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-918
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card