CVE:CVE-2022-22117
CNNVD:CNNVD-202201-672
Directus是一个实时 Api 和应用程序仪表板。用于管理 Sql 数据库内容。
Directus存在跨站脚本漏洞，该漏洞允许在媒体上传功能中无限制地上传.html文件，这导致了跨站点脚本漏洞。低特权攻击者可利用该漏洞可以将精心制作的HTML文件作为配置文件上传，当管理员或其他用户打开它时，XSS有效负载就会被触发。
solution:Upgrade rangerstudio directus to a higher version than 9.4.1,9.0.0,9.0.0:alpha10,9.0.0:alpha11,9.0.0:alpha12,9.0.0:alpha13,9.0.0:alpha14,9.0.0:alpha15,9.0.0:alpha16,9.0.0:alpha17,9.0.0:alpha18,9.0.0:alpha19,9.0.0:alpha20,9.0.0:alpha21,9.0.0:alpha22,9.0.0:alpha23,9.0.0:alpha24,9.0.0:alpha25,9.0.0:alpha26,9.0.0:alpha27,9.0.0:alpha31,9.0.0:alpha32,9.0.0:alpha33,9.0.0:alpha34,9.0.0:alpha35,9.0.0:alpha36,9.0.0:alpha37,9.0.0:alpha38,9.0.0:alpha39,9.0.0:alpha4,9.0.0:alpha40,9.0.0:alpha41,9.0.0:alpha42,9.0.0:alpha5,9.0.0:alpha6,9.0.0:alpha7,9.0.0:alpha8,9.0.0:alpha9,9.0.0:beta0,9.0.0:beta1,9.0.0:beta10,9.0.0:beta11,9.0.0:beta12,9.0.0:beta13,9.0.0:beta14,9.0.0:beta2,9.0.0:beta3,9.0.0:beta4,9.0.0:beta5,9.0.0:beta7,9.0.0:beta8,9.0.0:beta9,9.0.0:rc0,9.0.0:rc1,9.0.0:rc10,9.0.0:rc100,9.0.0:rc101,9.0.0:rc11,9.0.0:rc12,9.0.0:rc13,9.0.0:rc14,9.0.0:rc15,9.0.0:rc17,9.0.0:rc18,9.0.0:rc19,9.0.0:rc2,9.0.0:rc20,9.0.0:rc21,9.0.0:rc22,9.0.0:rc23,9.0.0:rc24,9.0.0:rc25,9.0.0:rc26,9.0.0:rc27,9.0.0:rc28,9.0.0:rc29,9.0.0:rc3,9.0.0:rc30,9.0.0:rc31,9.0.0:rc32,9.0.0:rc33,9.0.0:rc34,9.0.0:rc35,9.0.0:rc36,9.0.0:rc37,9.0.0:rc38,9.0.0:rc39,9.0.0:rc4,9.0.0:rc40,9.0.0:rc41,9.0.0:rc42,9.0.0:rc43,9.0.0:rc44,9.0.0:rc45,9.0.0:rc46,9.0.0:rc47,9.0.0:rc48,9.0.0:rc49,9.0.0:rc5,9.0.0:rc50,9.0.0:rc51,9.0.0:rc52,9.0.0:rc53,9.0.0:rc54,9.0.0:rc55,9.0.0:rc56,9.0.0:rc57,9.0.0:rc58,9.0.0:rc59,9.0.0:rc6,9.0.0:rc60,9.0.0:rc61,9.0.0:rc62,9.0.0:rc63,9.0.0:rc64,9.0.0:rc65,9.0.0:rc66,9.0.0:rc67,9.0.0:rc68,9.0.0:rc69,9.0.0:rc7,9.0.0:rc70,9.0.0:rc71,9.0.0:rc72,9.0.0:rc73,9.0.0:rc74,9.0.0:rc75,9.0.0:rc76,9.0.0:rc77,9.0.0:rc78,9.0.0:rc79,9.0.0:rc8,9.0.0:rc80,9.0.0:rc81,9.0.0:rc82,9.0.0:rc83,9.0.0:rc84,9.0.0:rc85,9.0.0:rc86,9.0.0:rc87,9.0.0:rc88,9.0.0:rc89,9.0.0:rc9,9.0.0:rc90,9.0.0:rc91,9.0.0:rc92,9.0.0:rc93,9.0.0:rc94,9.0.0:rc95,9.0.0:rc96,9.0.0:rc97,9.0.0:rc98,9.0.0:rc99,and avoid the version [9.0.1,9.4.1],9.0.0,9.0.0:alpha10,9.0.0:alpha11,9.0.0:alpha12,9.0.0:alpha13,9.0.0:alpha14,9.0.0:alpha15,9.0.0:alpha16,9.0.0:alpha17,9.0.0:alpha18,9.0.0:alpha19,9.0.0:alpha20,9.0.0:alpha21,9.0.0:alpha22,9.0.0:alpha23,9.0.0:alpha24,9.0.0:alpha25,9.0.0:alpha26,9.0.0:alpha27,9.0.0:alpha31,9.0.0:alpha32,9.0.0:alpha33,9.0.0:alpha34,9.0.0:alpha35,9.0.0:alpha36,9.0.0:alpha37,9.0.0:alpha38,9.0.0:alpha39,9.0.0:alpha4,9.0.0:alpha40,9.0.0:alpha41,9.0.0:alpha42,9.0.0:alpha5,9.0.0:alpha6,9.0.0:alpha7,9.0.0:alpha8,9.0.0:alpha9,9.0.0:beta0,9.0.0:beta1,9.0.0:beta10,9.0.0:beta11,9.0.0:beta12,9.0.0:beta13,9.0.0:beta14,9.0.0:beta2,9.0.0:beta3,9.0.0:beta4,9.0.0:beta5,9.0.0:beta7,9.0.0:beta8,9.0.0:beta9,9.0.0:rc0,9.0.0:rc1,9.0.0:rc10,9.0.0:rc100,9.0.0:rc101,9.0.0:rc11,9.0.0:rc12,9.0.0:rc13,9.0.0:rc14,9.0.0:rc15,9.0.0:rc17,9.0.0:rc18,9.0.0:rc19,9.0.0:rc2,9.0.0:rc20,9.0.0:rc21,9.0.0:rc22,9.0.0:rc23,9.0.0:rc24,9.0.0:rc25,9.0.0:rc26,9.0.0:rc27,9.0.0:rc28,9.0.0:rc29,9.0.0:rc3,9.0.0:rc30,9.0.0:rc31,9.0.0:rc32,9.0.0:rc33,9.0.0:rc34,9.0.0:rc35,9.0.0:rc36,9.0.0:rc37,9.0.0:rc38,9.0.0:rc39,9.0.0:rc4,9.0.0:rc40,9.0.0:rc41,9.0.0:rc42,9.0.0:rc43,9.0.0:rc44,9.0.0:rc45,9.0.0:rc46,9.0.0:rc47,9.0.0:rc48,9.0.0:rc49,9.0.0:rc5,9.0.0:rc50,9.0.0:rc51,9.0.0:rc52,9.0.0:rc53,9.0.0:rc54,9.0.0:rc55,9.0.0:rc56,9.0.0:rc57,9.0.0:rc58,9.0.0:rc59,9.0.0:rc6,9.0.0:rc60,9.0.0:rc61,9.0.0:rc62,9.0.0:rc63,9.0.0:rc64,9.0.0:rc65,9.0.0:rc66,9.0.0:rc67,9.0.0:rc68,9.0.0:rc69,9.0.0:rc7,9.0.0:rc70,9.0.0:rc71,9.0.0:rc72,9.0.0:rc73,9.0.0:rc74,9.0.0:rc75,9.0.0:rc76,9.0.0:rc77,9.0.0:rc78,9.0.0:rc79,9.0.0:rc8,9.0.0:rc80,9.0.0:rc81,9.0.0:rc82,9.0.0:rc83,9.0.0:rc84,9.0.0:rc85,9.0.0:rc86,9.0.0:rc87,9.0.0:rc88,9.0.0:rc89,9.0.0:rc9,9.0.0:rc90,9.0.0:rc91,9.0.0:rc92,9.0.0:rc93,9.0.0:rc94,9.0.0:rc95,9.0.0:rc96,9.0.0:rc97,9.0.0:rc98,9.0.0:rc99