CVE-2024-34709

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry time which is set to 1 day by default. Making it effectively a long lived unrevokable stateless token instead of the stateful session token it was meant to be. This vulnerability is fixed in 10.11.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
directus	directus	>= 10.10.0, < 10.11.0

References

https://github.com/directus/directus/commit/a6172f8a6a0f31a6bf4305a090de172ebfb63bcfPatch
https://github.com/directus/directus/security/advisories/GHSA-g65h-35f3-x2w3Exploit, Vendor Advisory
https://github.com/directus/directus/commit/a6172f8a6a0f31a6bf4305a090de172ebfb63bcfPatch
https://github.com/directus/directus/security/advisories/GHSA-g65h-35f3-x2w3Exploit, Vendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-34713.4The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make CVE-2024-347107.1Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious Jav CVE-2024-347118.2GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that CVE-2024-347126.5Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBa CVE-2024-347133.5sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.CVE-2024-347147.6The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem.CVE-2024-347153.3Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persiste CVE-2024-347166.1PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with custo CVE-2024-347175.3PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous m CVE-2024-347197.8In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege CVE-2024-34725.9The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to CVE-2024-347207.8In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp, there is a possible