https://db.gcve.eu/sightings/feed 2026-05-03T08:43:13.199726+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent sightings. https://db.gcve.eu/sighting/487ca13e-ce57-4ec0-a490-c1c2a3a14054/export 2026-05-03T08:43:13.585545+00:00 cedric http://db.gcve.eu/user/cedric {"uuid": "487ca13e-ce57-4ec0-a490-c1c2a3a14054", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-J3RG-3RGM-537H", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/5302", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-26492\n\ud83d\udd25 CVSS Score: 5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)\n\ud83d\udd39 Description: Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to `/files/import`). An attacker can bypass the security controls by performing a DNS rebinding attack and view sensitive data from internal servers or perform a local port scan. An attacker can exploit this vulnerability to access highly sensitive internal server(s) and steal sensitive information. This issue was fixed in version 9.23.0.\n\ud83d\udccf Published: 2023-03-03T21:49:02.314Z\n\ud83d\udccf Modified: 2025-02-25T15:02:38.689Z\n\ud83d\udd17 References:\n1. https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h\n2. https://github.com/directus/directus/commit/ff53d3e69a602d05342e15d9bb616884833ddbff\n3. https://github.com/directus/directus/releases/tag/v9.23.0", "creation_timestamp": "2025-02-25T15:23:24.000000Z"} 2025-02-25T15:23:24+00:00