Unrated severityNVD Advisory· Published Aug 15, 2024· Updated May 19, 2025
Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options
CVE-2024-6533
Description
Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- fluidattacks.com/advisories/bocellimitrethird-party-advisory
- directus.iomitreproduct
News mentions
0No linked articles in our index yet.