-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | < 11.13.0 | 11.13.0 |
| @directus/api | npm | < 32.0.0 | 32.0.0 |
Miggo AIRoot Cause AnalysisThe analysis of the provided security advisory and the associated commit 7737d56e096f95edfbdf861a3c08999ad31ce204 points directly to a flaw in how search queries were constructed. The vulnerability description explains that concealed fields were searchable if a user had read permissions, allowing for data enumeration. The commit patch modifies the api/src/database/run-ast/lib/apply-query/search.ts file, specifically within the applySearch function. The change involves adding a condition to the filter that prepares the list of fields to be searched. The added condition, && field.special.includes('conceal') !== true, explicitly removes fields marked as 'conceal' from the search operation. This directly mitigates the described vulnerability. Therefore, the applySearch function is identified as the vulnerable function because it was responsible for including sensitive, concealed fields in the search logic.
applySearchapi/src/database/run-ast/lib/apply-query/search.ts
JavaScriptJavaScriptOngoing coverage of React2Shell