CVE-2024-39717 kev in the critical feed json
The Versa Director GUI provides an option to customize the look and feel of the user interface.
published 2024-08-22 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-38202
- cvss
- 6.6
- version 3.0, CNA
- cisa kev
- Exploited
- added 2024-08-23
- epss
- 4.0%
- EPSS 4.0% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- versa-networks versa_director 21.2.3_2024-06-21, 22.1.2_2024-06-21, 22.1.3_2024-06-21
Timeline
- Published
- Added to CISA KEV
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 2 y ago
- Patch by
- 2024-09-13 (2 y ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Versa, Director
- CISA name
- Versa Director Dangerous File Type Upload Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
3.99% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 6.6 | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Versa Director
- versa-networks versa_director
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
-
versa-networks.com
/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39717
government-resource, us-government-resource
Sources
- CVE List CVE-2024-39717
- NVD CVE-2024-39717
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.