CVE-2024-54128

{"id": "CVE-2024-54128", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}]}, "published": "2024-12-05T17:15:15.130", "references": [{"url": "https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0."}, {"lang": "es", "value": "Directus es una API en tiempo real y un panel de control de aplicaciones para administrar el contenido de bases de datos SQL. La funci\u00f3n de comentarios implement\u00f3 un filtro para evitar que los usuarios agreguen caracteres restringidos, como etiquetas HTML. Sin embargo, este filtro opera en el lado del cliente, lo que puede eludirse, lo que hace que la aplicaci\u00f3n sea vulnerable a la inyecci\u00f3n de HTML. Esta vulnerabilidad se solucion\u00f3 en 10.13.4 y 11.2.0."}], "lastModified": "2025-11-19T14:47:35.850", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9F70EDE4-3E78-4A02-BAF4-5A41DEE2E49E", "versionEndExcluding": "10.13.4", "versionStartIncluding": "10.10.0"}, {"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "5E0B8B4B-9804-44D4-987F-C00A55762DF1", "versionEndExcluding": "11.2.2", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}