CVE-2024-39717

HIGH CISA KEV EPSS 89.3%
Published Aug 22, 20241y ago · Modified Jun 17, 20262w ago
7.2 CVSS 3.1
High
Find Similar
Published Aug 22, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Aug 23, 2024 1y ago
KEV Due Sep 13, 2024 658d overdue

Description

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

CVSS Details

Base Score
7.2
Exploitability
1.2
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 658d
Added
Aug 23, 2024
Due
Sep 13, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
89.3% percentile
Exploit & Patch Status
Actively Exploited (KEV)
No Patch Available

Weaknesses 1

CWE-434 Unrestricted Upload of File with Dangerous Type Resource Mgmt

Affected Products 5

VendorProductVersionRange
versa-networksversa_director21.2.2any
versa-networksversa_director21.2.3any
versa-networksversa_director22.1.1any
versa-networksversa_director22.1.2any
versa-networksversa_director22.1.3any

References 2

  • versa-networks.com https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/
    Vendor Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39717
    US Government Resource

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.