CVE-2024-6534mediumCWE-639

CVE-2024-6534: medium-severity vulnerability in Directus

Directus 10.13.0 - Insecure object reference via PATH presets

Published · Updated

Follow this CVE+ Monitor directus+ Monitor directus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.3%
Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Directus · Directus
Related CVEs — Directus

In the same product, most dangerous first.

CVE-2026-10716HIGHDirectus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creationEPSS 0.4%CVE-2024-6533MEDIUMDirectus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_optionsEPSS 0.4%