Arbitrary JavaScript Execution Leads to Account Takeover Vulnerability in Directus v10.13.0
CVE-2024-6533

5.4MEDIUM

Key Information:

Vendor

Directus

Status
Directus
Vendor
CVE Published:
15 August 2024

What is CVE-2024-6533?

Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.

Affected Version(s)

Directus 10.13.0

References

https://fluidattacks.com/advisories/bocelli
third-party-advisory
https://directus.io/
product

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.