This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2024-6534 | BDVDB-2026-245643 Detail

DirectusDirectus

Description#

Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.

Impact#

CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels

Weaknesses#

  • CWE-639 Authorization Bypass Through User-Controlled Key

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.