CVE-2024-39717

View on CVE.org
Published Aug 22, 2024 CVSS 3.1 · 7.2 High EPSS 4.0% KEV · Listed
Description
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-38202 The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.05514}

 epss

{'score': 0.0707}
Type Values Removed Values Added
Description The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in. Severity: HIGH Exploitation Status: Versa Networks is aware of one confirmed customer reported instance where this vulnerability was exploited because the Firewall guidelines which were published in 2015 & 2017 were not implemented by that customer. This non-implementation resulted in the bad actor being able to exploit this vulnerability without using the GUI. In our testing (not exhaustive, as not all numerical versions of major browsers were tested) the malicious file does not get executed on the client. There are reports of others based on backbone telemetry observations of a 3rd party provider, however these are unconfirmed to date. The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
References
Type Values Removed Values Added
CPEs cpe:2.3:a:versa-networks:versa_director:21.2.2:*:*:*:*:*:*:*
cpe:2.3:a:versa-networks:versa_director:21.2.3:*:*:*:*:*:*:*
cpe:2.3:a:versa-networks:versa_director:22.1.1:*:*:*:*:*:*:*
cpe:2.3:a:versa-networks:versa_director:22.1.2:*:*:*:*:*:*:*
cpe:2.3:a:versa-networks:versa_director:22.1.3:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2024-08-23'}
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2024-08-23'}
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2024-08-23'}
Type Values Removed Values Added
First Time appeared Versa-networks
Versa-networks versa Director
Weaknesses CWE-434
CPEs cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:*
Vendors & Products Versa-networks
Versa-networks versa Director
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in. Severity: HIGH Exploitation Status: Versa Networks is aware of one confirmed customer reported instance where this vulnerability was exploited because the Firewall guidelines which were published in 2015 & 2017 were not implemented by that customer. This non-implementation resulted in the bad actor being able to exploit this vulnerability without using the GUI. In our testing (not exhaustive, as not all numerical versions of major browsers were tested) the malicious file does not get executed on the client. There are reports of others based on backbone telemetry observations of a 3rd party provider, however these are unconfirmed to date.
References
Metrics cvssV3_0

{'score': 6.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (8)
Weaknesses

Sources

Status
PUBLISHED
Assigner
hackerone
Published
Updated
Oct 21, 2025, 10:55 PM
Reserved
Jun 28, 2024, 1:04 AM

View source JSON

Updated
Aug 23, 2024, 4:37 PM

JSON

Status
Analyzed
Published
Aug 22, 2024, 7:15 PM
Modified
Jun 17, 2026, 7:42 AM

View source JSON

No data.

No data.