CVE-2024-54128CWE-80

Directus has an HTML Injection in Comment

Medium · published December 5, 2024

CVSS v3.1
5.7
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2024-12-05T16:55Z
EPSS history
Timeline
  • 05 DEC 16:55Z
    Directus has an HTML Injection in Comment
    cvelistv5