Home / Vulnerabilities / CVE-2024-39717
MEDIUM SEVERITY
CVE-2024-39717 Versa · Director

Versa Director Dangerous File Type Upload Vulnerability

Technical Severity

CVSS v3.1 Metrics

MEDIUM
6.6 / 10
Minimal Risk Critical
Vector Specification
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitation Likelihood

EPSS Prediction

4.64 %
Predictive Probability
Percentile Rank
89.0 th

Documented as more likely to be exploited than 89.0% of known CVEs.

Detection Date

Aug 23, 2024

Remediation Due

Sep 13, 2024

CISA Catalog Active

Threat Analysis

The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/

https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/
NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2024-39717