Actively exploited · Published Aug 22, 2024 · Assigned by hackerone
CVE-2024-39717
Medium 6.6 Exploited
In plain English
A medium-severity unrestricted file upload in Director from Versa. Attackers are actively exploiting it in the wild (listed by CISA on August 23, 2024). The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 91% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Sep 13, 2024.
Official description
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H