CVE-2024-6533

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Directus	Directus	—
directus	directus	10.13.0

References

https://directus.io/Product
https://fluidattacks.com/advisories/bocelliExploit, Third Party Advisory

Timeline

Published: Aug 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-65344.3Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This CVE-2024-65355.3A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the CVE-2024-65365.4The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privileg CVE-2024-65385.3A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL t CVE-2024-65394.8A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the f CVE-2024-65405.3Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authoriz CVE-2024-65416.8The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This a CVE-2024-65426.5Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk <= 2.0.0p39, < 2.1.0p47, < 2.2.0p32 and < 2.3.0p11 allows a CVE-2024-65445.3The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due t CVE-2024-65455.3The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due CVE-2024-65465.3The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is CVE-2024-65475.3The Add Admin CSS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to th