CVE-2023-38503

Summary

CVE-2023-38503 is a vulnerability affecting Directus, a real-time API and App dashboard for managing SQL database content, between versions 10.3.0 and 10.5.0. The issue lies in the improper checking of permission filters during GraphQL subscriptions, enabling unauthorized users to receive updates they should not have access to. This vulnerability can potentially expose sensitive information from the `directus_users` collection. Users on affected versions are advised to update to version 10.5.0 or disable GraphQL subscriptions as a workaround.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.