CVE-2024-39717
Vulnerability from cvelistv5
Published
2024-08-22 18:47
Modified
2024-09-04 03:55
Severity ?
6.6 (Medium) - CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
References
support@hackerone.comhttps://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/Vendor Advisory
Impacted products
Vendor Product Version
CISA Known exploited vulnerability
Data from the Known Exploited Vulnerabilities Catalog

Date added: 2024-08-23

Due date: 2024-09-13

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Used in ransomware: Unknown

Notes: https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2024-39717

Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "versa_director",
            "vendor": "versa-networks",
            "versions": [
              {
                "status": "affected",
                "version": "21.2.2"
              },
              {
                "lessThan": "21.2.3_2024-06-21",
                "status": "affected",
                "version": "21.2.3",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "22.1.1"
              },
              {
                "lessThan": "22.1.2_2024-06-21",
                "status": "affected",
                "version": "22.1.2",
                "versionType": "custom"
              },
              {
                "lessThan": "22.1.3_2024-06-21",
                "status": "affected",
                "version": "22.1.3",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39717",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-30T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-08-23",
                "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T03:55:39.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Director",
          "vendor": "Versa",
          "versions": [
            {
              "lessThanOrEqual": "21.2.2",
              "status": "affected",
              "version": "21.2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "21.2.3 before 2024-06-21",
              "status": "affected",
              "version": "21.2.3 before 2024-06-21",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "22.1.1",
              "status": "affected",
              "version": "22.1.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "22.1.2 before 2024-06-21",
              "status": "affected",
              "version": "22.1.2 before 2024-06-21",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "22.1.3 before 2024-06-21",
              "status": "affected",
              "version": "22.1.3 before 2024-06-21",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The \u201cChange Favicon\u201d (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-27T15:49:41.227Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-39717",
    "datePublished": "2024-08-22T18:47:12.171Z",
    "dateReserved": "2024-06-28T01:04:08.821Z",
    "dateUpdated": "2024-09-04T03:55:39.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2024-39717",
      "cwes": "[\"CWE-434\"]",
      "dateAdded": "2024-08-23",
      "dueDate": "2024-09-13",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/;   https://nvd.nist.gov/vuln/detail/CVE-2024-39717",
      "product": "Director",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The \u201cChange Favicon\u201d (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.",
      "vendorProject": "Versa",
      "vulnerabilityName": "Versa Director Dangerous File Type Upload Vulnerability"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39717\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2024-08-22T19:15:09.173\",\"lastModified\":\"2024-08-28T19:47:25.410\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The \u201cChange Favicon\u201d (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.\"},{\"lang\":\"es\",\"value\":\"La GUI de Versa Director ofrece una opci\u00f3n para personalizar la apariencia de la interfaz de usuario. Esta opci\u00f3n solo est\u00e1 disponible para un usuario que haya iniciado sesi\u00f3n con Provider-Data-Center-Admin o Provider-Data-Center-System-Admin. (Los usuarios de nivel de inquilino no tienen este privilegio). La opci\u00f3n \\\"Cambiar Favicon\\\" (icono favorito) se puede utilizar incorrectamente para cargar un archivo malicioso que termina con la extensi\u00f3n .png y se hace pasar por un archivo de imagen. Esto solo es posible despu\u00e9s de que un usuario con Provider-Data-Center-Admin o Provider-Data-Center-System-Admin se haya autenticado e iniciado correctamente. Gravedad: ALTA Estado de explotaci\u00f3n: Versa Networks tiene conocimiento de un caso confirmado que inform\u00f3 un cliente en el que esto La vulnerabilidad fue explotada porque ese cliente no implement\u00f3 las pautas de firewall que se publicaron en 2015 y 2017. Esta no implementaci\u00f3n result\u00f3 en que el mal actor pudiera explotar esta vulnerabilidad sin usar la GUI. En nuestras pruebas (no exhaustivas, ya que no se probaron todas las versiones num\u00e9ricas de los principales navegadores), el archivo malicioso no se ejecuta en el cliente. Hay informes de otros basados en observaciones de telemetr\u00eda troncal de un proveedor externo, sin embargo, estos no est\u00e1n confirmados hasta la fecha.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.7,\"impactScore\":5.9}]},\"cisaExploitAdd\":\"2024-08-23\",\"cisaActionDue\":\"2024-09-13\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Versa Director Dangerous File Type Upload Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-434\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-434\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:versa-networks:versa_director:21.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59E2F7B6-200B-4008-A5C6-FD33B05DFF8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:versa-networks:versa_director:21.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD6E1984-CC7D-47FB-9469-506D5B9B7764\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:versa-networks:versa_director:22.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE334340-8D19-4A10-AB58-B9028D96851C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:versa-networks:versa_director:22.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6870728-68E3-4B20-8846-184623B95B56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:versa-networks:versa_director:22.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F42DE9E0-BECA-413B-9CEA-DA8C2CAAAD11\"}]}]}],\"references\":[{\"url\":\"https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.