What is GHSA-5mhg-wv8w-p59j?

GHSA-5mhg-wv8w-p59j is a security advisory published by GitHub Security Advisories with Medium severity. Directus version number disclosure

Which CVE IDs does GHSA-5mhg-wv8w-p59j cover?

GHSA-5mhg-wv8w-p59j covers the following CVE IDs: CVE-2024-27296. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5mhg-wv8w-p59j?

GHSA-5mhg-wv8w-p59j has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-5mhg-wv8w-p59j?

GHSA-5mhg-wv8w-p59j affects 1 product, including: npm/directus:\u003c= 10.8.2.

GHSA-5mhg-wv8w-p59jMediumCVSS 5.3

Directus version number disclosure

Vendor

GitHub Security Advisories

Published

March 1, 2024

Last Modified

March 21, 2026

🔗 CVE IDs covered (1)

CVE-2024-27296 →

📋 Description

Impact

Currently the exact Directus version number is being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version.

Patches

The problem has been resolved in versions 10.8.3 and newer

Workarounds

None

🎯 Affected products1

npm/directus:<= 10.8.2

🔗 References (4)

https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j
https://nvd.nist.gov/vuln/detail/CVE-2024-27296
https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0
https://github.com/advisories/GHSA-5mhg-wv8w-p59j