MEDIUM
Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options
Published Aug 15, 2024
5.4
MEDIUMCVSS 3.1
EPSS 0.38%
Description
Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.
Affected products
No data.
-
Affected
- 10.13.0
No Red Hat product state for this CVE.
directus
npm
Introduced 0 Fixed 11.3.3
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | directus | 0 | 11.3.3 |
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- https://directus.io/ product
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2634 Advisory
- https://fluidattacks.com/advisories/bocelli third-party-advisoryExploitThird Party Advisory
- https://github.com/advisories/GHSA-9qrm-48qf-r2rw Advisory
- https://github.com/directus/directus/security/advisories/GHSA-9qrm-48qf-r2rw
| Link | Providers | Tags |
|---|---|---|
| https://directus.io/ | product | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2634 | Advisory | |
| https://fluidattacks.com/advisories/bocelli | third-party-advisoryExploitThird Party Advisory | |
| https://github.com/advisories/GHSA-9qrm-48qf-r2rw | Advisory | |
| https://github.com/directus/directus/security/advisories/GHSA-9qrm-48qf-r2rw |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Fluid Attacks
Published Aug 15, 2024
Updated May 19, 2025
Reserved Jul 5, 2024
Link CVE-2024-6533
CISA Vulnrichment
Updated Aug 16, 2024
Red Hat
No data
GitHub
Link GHSA-9QRM-48QF-R2RW