Is CVE-2024-6534 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-6534 being exploited in the wild.

How severe is CVE-2024-6534?

Low severity, with a CVSS score of 3.1, published 27 August 2024.

Which products and versions are affected?

directus (npm) SEMVER:introduced=0,fixed=10.13.2.

Is there a fix for CVE-2024-6534?

Yes. directus (npm): upgrade to 10.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-6534 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-6534?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-6534: Directus IDOR in presets allows reassignment to other users

CVE-2024-6534 · Severity: low · CVSS 3.1 · Published 2024-08-27

Directus is a data platform used to manage databases and content through a visual interface. A security flaw allows a logged-in user to modify their own interface settings (presets) and then reassign those settings to a different user. If combined with other vulnerabilities, this could potentially lead to an attacker gaining control over another user's account or manipulating what they see in the management dashboard.

Technologies: directus (npm). Vendors: npm.

Quick answers

Is CVE-2024-6534 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-6534 being exploited in the wild.
How severe is CVE-2024-6534?: Low severity, with a CVSS score of 3.1, published 27 August 2024.
Which products and versions are affected?: directus (npm) SEMVER:introduced=0,fixed=10.13.2.
Is there a fix for CVE-2024-6534?: Yes. directus (npm): upgrade to 10.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-6534 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-6534?: Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

directus (npm): upgrade to 10.13.2 or later
```
npm install directus@10.13.2
```

Technical details

An Insecure Direct Object Reference (IDOR) exists in Directus v10.13.0 and v10.13.1. While the application validates the 'user' parameter during the initial creation of a preset (POST /presets), it fails to perform the same validation during an update (PATCH /presets/{id}). An authenticated attacker can create a preset, then use a PATCH request to change the 'user' field to a victim's ID. This allows the attacker to inject malicious configurations into another user's view. When chained with other vulnerabilities like CVE-2024-6533, this can lead to account takeover. The issue is fixed in version 10.13.2.

Affected products

Directus directus <= 10.13.1

Identifiers

CVE-2024-6534
GHSA-3fff-gqw3-vj86

Timeline

2024-08-15: advisory: NVD Published Date
2024-08-27: disclosed: GitHub Advisory published
2024-08-27: patched: Fix released in version 10.13.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.