{"id":"CVE-2024-6533","summary":"Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options","details":"Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.","modified":"2026-07-15T01:49:06.248910366Z","published":"2024-08-15T03:04:08.250Z","database_specific":{"cna_assigner":"Fluid Attacks","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6533.json"},"references":[{"type":"WEB","url":"https://directus.io/"},{"type":"ADVISORY","url":"https://fluidattacks.com/advisories/bocelli"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6533.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6533"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/directus/directus","events":[{"introduced":"844d4e7f336e02d5cd1881b7964625abe7ea8d43"},{"last_affected":"844d4e7f336e02d5cd1881b7964625abe7ea8d43"}],"database_specific":{"extracted_events":[{"introduced":"10.13.0"},{"last_affected":"10.13.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:monospace:directus:10.13.0:*:*:*:*:*:*:*"}}],"versions":["10.13.0","v10.13.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6533.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}