CVE-2024-6534

Published Aug 15, 2024

Last updated 3 months ago

CVSS medium 4.3

Overview

Description: Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.
Source: help@fluidattacks.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Weaknesses

help@fluidattacks.com: CWE-639

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:monospace:directus:10.13.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "59902E26-19CC-4A1A-9BB4-54C1EE864B96"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References