Description
Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Directus | Directus | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | directus | < 11.3.3 | 11.3.3 | GHSA-9qrm-48qf-r2rw |
References
- https://fluidattacks.com/advisories/bocelli third-party-advisory
- https://directus.io/ product