CVE-2024-36128: Directus is soft-locked by providing a string value to random string util

June 4, 2024

This counts as an unauthenticated denial of service attack vector so this impacts all unpatched instances reachable over the internet.

References

github.com/advisories/GHSA-632p-p495-25m5
github.com/directus/directus
github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b
github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5
nvd.nist.gov/vuln/detail/CVE-2024-36128

Code Behaviors & Features

Detect and mitigate CVE-2024-36128 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →