CVE-2024-6534: 
JavaScript vulnerability analysis and mitigation

CVE-2024-6534 affects Directus v10.13.0, allowing an authenticated external attacker to modify presets created by the same user to assign them to another user. The vulnerability was discovered and disclosed in August 2024, impacting the Directus content management system. The issue stems from insufficient validation of the user parameter in PATCH requests to the presets endpoint (NVD, Fluid Attacks).

The vulnerability exists because the application only validates the user parameter in the POST /presets request but not in the PATCH request. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The weakness is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD).

When exploited, this vulnerability allows an attacker to modify presets created by their own user account and reassign them to another user. When chained with CVE-2024-6533, this vulnerability could potentially lead to account takeover (NVD, Fluid Attacks).

As of the disclosure date, there is no official patch available for this vulnerability (Fluid Attacks).