{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T20:28:30.069","vulnerabilities":[{"cve":{"id":"CVE-2024-6534","sourceIdentifier":"help@fluidattacks.com","published":"2024-08-15T04:15:07.937","lastModified":"2026-06-17T08:18:12.123","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover."},{"lang":"es","value":" Directus v10.13.0 permite a un atacante externo autenticado modificar los ajustes preestablecidos creados por el mismo usuario para asignarlos a otro usuario. Esto es posible porque la aplicación solo valida el parámetro de usuario en la solicitud 'POST /presets' pero no en la solicitud PATCH. Cuando se encadena con CVE-2024-6533, podría resultar en una apropiación de la cuenta."}],"affected":[{"source":"help@fluidattacks.com","affectedData":[{"vendor":"Directus","product":"Directus","defaultStatus":"unknown","versions":[{"version":"10.13.0","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"monospace","product":"directus","defaultStatus":"unknown","cpes":["cpe:2.3:a:monospace:directus:*:*:*:*:*:*:*:*"],"versions":[{"version":"10.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"help@fluidattacks.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-08-15T14:09:09.537547Z","id":"CVE-2024-6534","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"help@fluidattacks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:monospace:directus:10.13.0:*:*:*:*:*:*:*","matchCriteriaId":"59902E26-19CC-4A1A-9BB4-54C1EE864B96"}]}]}],"references":[{"url":"https://directus.io/","source":"help@fluidattacks.com","tags":["Product"]},{"url":"https://fluidattacks.com/advisories/capaldi","source":"help@fluidattacks.com","tags":["Third Party Advisory"]}]}}]}