CVE-2024-10385: Stored XSS in DirectAdmin Evo Skin
Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code. If an admin views the ticket, the script might perform actions with their privileges, including command execution. This issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10385?
CVE-2024-10385 is classified as a medium severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2024-10385?
To mitigate CVE-2024-10385, update the DirectAdmin Evolution Skin to version 1.668 or later.
Who is affected by CVE-2024-10385?
CVE-2024-10385 affects users of the DirectAdmin Evolution Skin prior to version 1.668.
What type of attack does CVE-2024-10385 allow?
CVE-2024-10385 allows low-privileged users to perform cross-site scripting attacks by injecting and storing malicious JavaScript code.
What are the consequences of exploiting CVE-2024-10385?
Exploitation of CVE-2024-10385 could allow an attacker to execute scripts with the privileges of an admin user when they view the injected content.