Vulnerability · Published Dec 20, 2024 · Assigned by CERT-PL

CVE-2024-10385Stored XSS in DirectAdmin Evo Skin

High 8.6

In plain English

A high-severity cross-site scripting in DirectAdmin Evolution Skin from DirectAdmin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.7%top 48.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code. If an admin views the ticket, the script might perform actions with their privileges, including command execution. This issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.

Affected products (as reported)

Vendor	Product	Versions
DirectAdmin	DirectAdmin Evolution Skin	0 – before 1.668

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N

References

https://cert.pl/en/posts/2024/12/CVE-2024-10385 third-party-advisory
https://www.directadmin.com/evolution.php product