UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28443

CWE-532: Insertion of Sensitive Information into Log File

Severity
Medium 5.5
Published
23 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.23.3
Also known as
GHSA-8vg2-wf3q-mwv7
Sources
NVD, Project advisories (GitHub)

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • Every version before 9.23.3
DirectusServers and applications · github:directus/directus
  • Version 9.23.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28443
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28443
  • GitHub Advisory Database https://github.com/advisories/GHSA-8vg2-wf3q-mwv7
  • github.com https://github.com/directus/directus/security/advisories/GHSA-8vg2-wf3q-mwv7