Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-3cgw-zr3k-3fen
Vulnerability ID VCID-3cgw-zr3k-3fen
Aliases CVE-2024-28238
GHSA-2ccr-g2rv-h677
Summary Session Token in URL in directus ### Impact When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user. ### Patches _Has the problem been patched? What versions should users upgrade to?_ ### Workarounds There's no workaround available. ### References _Are there any links users can visit to find out more?_
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-598 Use of GET Request Method With Sensitive Query Strings
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2024-28238
cvssv3.1_qr LOW https://github.com/advisories/GHSA-2ccr-g2rv-h677
cvssv3.1_qr LOW https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-28238
https://github.com/directus/directus
CVE-2024-28238 https://nvd.nist.gov/vuln/detail/CVE-2024-28238
GHSA-2ccr-g2rv-h677 https://github.com/advisories/GHSA-2ccr-g2rv-h677
GHSA-2ccr-g2rv-h677 https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.2556
EPSS Score 0.0009
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:03:35.632167+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/directus/CVE-2024-28238.yml 38.6.0