CVE-2024-10385 HIGH

CVE-2024-10385: Stored XSS in DirectAdmin Evo Skin

Vendor Directadmin

Product DirectAdmin Evolution Skin

Weakness CWE-79 · XSS

Published December 20, 2024

Last update December 20, 2024

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N

What the vulnerability does

01Description

Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code. If an admin views the ticket, the script might perform actions with their privileges, including command execution. This issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.

Key dates

02Disclosure timeline

December 20, 2024 CVE published

December 20, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-10385 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2020-3192 Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability CVE-2024-5413 Cross-Site Scripting (XSS) vulnerability on PhpMyBackupPro CVE-2025-23706 WordPress Jet Skinner for BuddyPress plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-48321 WordPress Accelerated Mobile Pages Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS) CVE-2024-51926 WordPress GreenCon plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability