Is CVE-2024-47822 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-47822 being exploited in the wild.

How severe is CVE-2024-47822?

Low severity, with a CVSS score of 3.1, published 14 April 2025.

Which products and versions are affected?

@directus/api (npm) SEMVER:introduced=0,fixed=21.0.0.

Is there a fix for CVE-2024-47822?

Yes. @directus/api (npm): upgrade to 21.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-47822 attacked?

It is attacked with local access.

Am I affected by CVE-2024-47822?

Check whether you run @directus/api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-47822: Directus access token exposure in logs

CVE-2024-47822 · Severity: low · CVSS 3.1 · Published 2025-04-14

Directus, a popular open-source content management and data platform, logs unredacted access tokens when the LOG_STYLE setting is configured to "raw". An attacker with access to these logs could extract long-lived authentication credentials and gain unauthorized administrative access to the system, potentially exposing or manipulating sensitive business data. Affected organizations should review their log retention and access controls, and rotate any static tokens that may have been exposed.

Technologies: @directus/api (npm). Vendors: npm.

Quick answers

Is CVE-2024-47822 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-47822 being exploited in the wild.
How severe is CVE-2024-47822?: Low severity, with a CVSS score of 3.1, published 14 April 2025.
Which products and versions are affected?: @directus/api (npm) SEMVER:introduced=0,fixed=21.0.0.
Is there a fix for CVE-2024-47822?: Yes. @directus/api (npm): upgrade to 21.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-47822 attacked?: It is attacked with local access.
Am I affected by CVE-2024-47822?: Check whether you run @directus/api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@directus/api (npm): upgrade to 21.0.0 or later
```
npm install @directus/api@21.0.0
```

Technical details

This vulnerability is a sensitive information disclosure issue (CWE-532) in the Directus API where authentication tokens passed in the query string are not redacted from logs when LOG_STYLE is set to "raw". The root cause is insufficient sanitization of request parameters before logging. The attack requires local access to logs, high privileges, and user interaction (someone must make a request with the token in the query string); however, the impact is high confidentiality loss if an attacker gains access to log files containing valid tokens. The vulnerability was patched in versions 10.13.2, 11.1.0, and 21.0.0 across the affected branches.

Affected products

Directus directus < 10.13.2, < 11.1.0 (before 21.0.0 fix)

Identifiers

CVE-2024-47822
GHSA-vw58-ph65-6rxp

Timeline

2024-10-08: disclosed
2024: patched: Fixed in versions 10.13.2, 11.1.0, and 21.0.0

References

https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.