CVE-2024-6533: Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options
First published: Thu Aug 15 2024(Updated: )
Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.
Credit: help@fluidattacks.com help@fluidattacks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/directus | <=10.13.0 | |
| Directus | =10.13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-6533?
CVE-2024-6533 has a high severity rating, indicating a significant security risk due to arbitrary JavaScript execution.
How do I fix CVE-2024-6533?
To fix CVE-2024-6533, upgrade Directus to a version later than 10.13.0 to ensure better input sanitization.
Who is affected by CVE-2024-6533?
CVE-2024-6533 affects users of Directus version 10.13.0 who have authentication rights.
What kind of attacks are possible with CVE-2024-6533?
CVE-2024-6533 allows authenticated attackers to execute arbitrary JavaScript in the client's browser.
Is CVE-2024-6533 a client-side vulnerability?
Yes, CVE-2024-6533 is primarily a client-side vulnerability that exploits unsanitized DOM injection.
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/references
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/softwarecombine
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-qf6h-p3mr-vmh5
- alias/CVE-2024-6533
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/event
- collector/github-advisory
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/npm
- vendor/monospace
- canonical/directus
- version/directus/10.13.0