CVE-2023-45820

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-755

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-458216.3Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. Duri CVE-2023-458225.3Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. Duri CVE-2023-458237.5Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. Duri CVE-2023-458244.3OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pag CVE-2023-458255.5ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object CVE-2023-458266.5Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not paramete CVE-2023-458279.8Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object p CVE-2023-458285.4Missing Authorization vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Exploiting Incorrectl CVE-2023-458295.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin fo CVE-2023-45837.5When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to ha CVE-2023-458309.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Onli CVE-2023-458318.8Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions.