Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-azpj-92x3-jyet
Vulnerability ID VCID-azpj-92x3-jyet
Aliases CVE-2024-28238
GHSA-2ccr-g2rv-h677
Summary Session Token in URL in directus ### Impact When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user. ### Patches _Has the problem been patched? What versions should users upgrade to?_ ### Workarounds There's no workaround available. ### References _Are there any links users can visit to find out more?_
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-598 Use of GET Request Method With Sensitive Query Strings
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2024-28238
cvssv3.1_qr LOW https://github.com/advisories/GHSA-2ccr-g2rv-h677
cvssv3.1 2.3 https://github.com/directus/directus
generic_textual LOW https://github.com/directus/directus
cvssv3.1 2.3 https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
cvssv3.1_qr LOW https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
generic_textual LOW https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
ssvc Track https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
cvssv3.1 2.3 https://nvd.nist.gov/vuln/detail/CVE-2024-28238
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2024-28238
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-28238
https://github.com/directus/directus
CVE-2024-28238 https://nvd.nist.gov/vuln/detail/CVE-2024-28238
GHSA-2ccr-g2rv-h677 https://github.com/advisories/GHSA-2ccr-g2rv-h677
GHSA-2ccr-g2rv-h677 https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-02T19:50:33Z/ Found at https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-28238
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.25649
EPSS Score 0.0009
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:47:21.103492+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/directus/CVE-2024-28238.yml 38.6.0