CVE-2022-22117
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-22117
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-22117.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-22117
- Published
- 2022-01-10T16:15:10Z
- Modified
- 2025-01-08T14:02:37.761284Z
- Summary
- [none]
- Details
-
In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.
- References
Affected packages
Git / github.com/directus/directus
Affected ranges
- Type
- GIT
- Repo
- https://github.com/directus/directus
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
v9.*
v9.0.0
v9.0.0-alpha.10
v9.0.0-alpha.11
v9.0.0-alpha.12
v9.0.0-alpha.13
v9.0.0-alpha.14
v9.0.0-alpha.15
v9.0.0-alpha.16
v9.0.0-alpha.17
v9.0.0-alpha.18
v9.0.0-alpha.19
v9.0.0-alpha.20
v9.0.0-alpha.21
v9.0.0-alpha.22
v9.0.0-alpha.23
v9.0.0-alpha.24
v9.0.0-alpha.25
v9.0.0-alpha.26
v9.0.0-alpha.27
v9.0.0-alpha.31
v9.0.0-alpha.32
v9.0.0-alpha.33
v9.0.0-alpha.34
v9.0.0-alpha.35
v9.0.0-alpha.36
v9.0.0-alpha.37
v9.0.0-alpha.38
v9.0.0-alpha.39
v9.0.0-alpha.4
v9.0.0-alpha.40
v9.0.0-alpha.41
v9.0.0-alpha.42
v9.0.0-alpha.5
v9.0.0-alpha.6
v9.0.0-alpha.7
v9.0.0-alpha.8
v9.0.0-alpha.9
v9.0.0-beta.0
v9.0.0-beta.1
v9.0.0-beta.10
v9.0.0-beta.11
v9.0.0-beta.12
v9.0.0-beta.13
v9.0.0-beta.14
v9.0.0-beta.2
v9.0.0-beta.3
v9.0.0-beta.4
v9.0.0-beta.5
v9.0.0-beta.7
v9.0.0-beta.8
v9.0.0-beta.9
v9.0.0-rc.0
v9.0.0-rc.1
v9.0.0-rc.10
v9.0.0-rc.100
v9.0.0-rc.101
v9.0.0-rc.11
v9.0.0-rc.12
v9.0.0-rc.13
v9.0.0-rc.14
v9.0.0-rc.15
v9.0.0-rc.17
v9.0.0-rc.18
v9.0.0-rc.19
v9.0.0-rc.2
v9.0.0-rc.20
v9.0.0-rc.21
v9.0.0-rc.22
v9.0.0-rc.23
v9.0.0-rc.24
v9.0.0-rc.25
v9.0.0-rc.26
v9.0.0-rc.27
v9.0.0-rc.28
v9.0.0-rc.29
v9.0.0-rc.3
v9.0.0-rc.30
v9.0.0-rc.31
v9.0.0-rc.32
v9.0.0-rc.33
v9.0.0-rc.34
v9.0.0-rc.35
v9.0.0-rc.36
v9.0.0-rc.37
v9.0.0-rc.38
v9.0.0-rc.39
v9.0.0-rc.4
v9.0.0-rc.40
v9.0.0-rc.41
v9.0.0-rc.42
v9.0.0-rc.43
v9.0.0-rc.44
v9.0.0-rc.45
v9.0.0-rc.46
v9.0.0-rc.47
v9.0.0-rc.48
v9.0.0-rc.49
v9.0.0-rc.5
v9.0.0-rc.50
v9.0.0-rc.51
v9.0.0-rc.52
v9.0.0-rc.53
v9.0.0-rc.54
v9.0.0-rc.55
v9.0.0-rc.56
v9.0.0-rc.57
v9.0.0-rc.58
v9.0.0-rc.59
v9.0.0-rc.6
v9.0.0-rc.60
v9.0.0-rc.61
v9.0.0-rc.62
v9.0.0-rc.63
v9.0.0-rc.64
v9.0.0-rc.65
v9.0.0-rc.66
v9.0.0-rc.67
v9.0.0-rc.68
v9.0.0-rc.69
v9.0.0-rc.7
v9.0.0-rc.70
v9.0.0-rc.71
v9.0.0-rc.72
v9.0.0-rc.73
v9.0.0-rc.74
v9.0.0-rc.75
v9.0.0-rc.76
v9.0.0-rc.77
v9.0.0-rc.78
v9.0.0-rc.79
v9.0.0-rc.8
v9.0.0-rc.80
v9.0.0-rc.81
v9.0.0-rc.82
v9.0.0-rc.83
v9.0.0-rc.84
v9.0.0-rc.85
v9.0.0-rc.86
v9.0.0-rc.87
v9.0.0-rc.88
v9.0.0-rc.89
v9.0.0-rc.9
v9.0.0-rc.90
v9.0.0-rc.91
v9.0.0-rc.92
v9.0.0-rc.93
v9.0.0-rc.94
v9.0.0-rc.95
v9.0.0-rc.96
v9.0.0-rc.97
v9.0.0-rc.98
v9.0.0-rc.99
v9.0.0-y.0
v9.0.1
v9.1.0
v9.1.1
v9.1.2
v9.2.0
v9.2.1
v9.2.2
v9.3.0
v9.4.0
v9.4.1