VULNERABILITY INTELLIGENCE

CVE-2024-6534

CVSS score4.3 MEDIUM
EPSS probability0.33%
CISA KEVNot currently listed
Published2024-08-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.

Weakness classification

  • help@fluidattacks.com: CWE-639

Primary references