Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2024-6533

Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Fluid Attacks

Description

Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Directus Directus

Default version status: unaffected

  • 10.13.0unknown

References