CVE-2024-6533: Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9qrm-48qf-r2rw. This link is maintained to preserve external references.
Original Description Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6533?
CVE-2024-6533 has a high severity rating, indicating a significant security risk due to arbitrary JavaScript execution.
How do I fix CVE-2024-6533?
To fix CVE-2024-6533, upgrade Directus to a version later than 10.13.0 to ensure better input sanitization.
Who is affected by CVE-2024-6533?
CVE-2024-6533 affects users of Directus version 10.13.0 who have authentication rights.
What kind of attacks are possible with CVE-2024-6533?
CVE-2024-6533 allows authenticated attackers to execute arbitrary JavaScript in the client's browser.
Is CVE-2024-6533 a client-side vulnerability?
Yes, CVE-2024-6533 is primarily a client-side vulnerability that exploits unsanitized DOM injection.