CVE-2024-39717
Versa Director Dangerous File Type Upload Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA notes
https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2024-39717
Description
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
Severity
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HAffected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Versa | Director | 21.2.2 to 21.2.2 21.2.3 before 2024-06-21 to <21.2.3 before 2024-06-21 22.1.1 to 22.1.1 22.1.2 before 2024-06-21 to 22.1.2 before 2024-06-21 22.1.3 before 2024-06-21 to 22.1.3 before 2024-06-21 |
References
1 LinksRecord Details
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.