The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Versa-networks |
|
Configuration 1 [-]
|
No data.
References
History
Tue, 27 Aug 2024 16:30:00 +0000
Tue, 27 Aug 2024 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in. Severity: HIGH Exploitation Status: Versa Networks is aware of one confirmed customer reported instance where this vulnerability was exploited because the Firewall guidelines which were published in 2015 & 2017 were not implemented by that customer. This non-implementation resulted in the bad actor being able to exploit this vulnerability without using the GUI. In our testing (not exhaustive, as not all numerical versions of major browsers were tested) the malicious file does not get executed on the client. There are reports of others based on backbone telemetry observations of a 3rd party provider, however these are unconfirmed to date. | The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in. |
| References |
|
Mon, 26 Aug 2024 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:versa-networks:versa_director:21.2.2:*:*:*:*:*:*:* cpe:2.3:a:versa-networks:versa_director:21.2.3:*:*:*:*:*:*:* cpe:2.3:a:versa-networks:versa_director:22.1.1:*:*:*:*:*:*:* cpe:2.3:a:versa-networks:versa_director:22.1.2:*:*:*:*:*:*:* cpe:2.3:a:versa-networks:versa_director:22.1.3:*:*:*:*:*:*:* |
|
| Metrics |
cvssV3_1
|
Mon, 26 Aug 2024 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
ssvc
|
Sun, 25 Aug 2024 08:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
kev
|
Sat, 24 Aug 2024 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
kev
|
Sat, 24 Aug 2024 05:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
kev
|
Fri, 23 Aug 2024 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Versa-networks
Versa-networks versa Director |
|
| Weaknesses | CWE-434 | |
| CPEs | cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Versa-networks
Versa-networks versa Director |
|
| Metrics |
ssvc
|
Thu, 22 Aug 2024 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in. Severity: HIGH Exploitation Status: Versa Networks is aware of one confirmed customer reported instance where this vulnerability was exploited because the Firewall guidelines which were published in 2015 & 2017 were not implemented by that customer. This non-implementation resulted in the bad actor being able to exploit this vulnerability without using the GUI. In our testing (not exhaustive, as not all numerical versions of major browsers were tested) the malicious file does not get executed on the client. There are reports of others based on backbone telemetry observations of a 3rd party provider, however these are unconfirmed to date. | |
| References |
|
|
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: hackerone
Published: 2024-08-22T18:47:12.171Z
Updated: 2024-09-04T03:55:39.426Z
Reserved: 2024-06-28T01:04:08.821Z
Link: CVE-2024-39717
Vulnrichment
Updated: 2024-08-23T16:37:24.904Z
NVD
Status : Analyzed
Published: 2024-08-22T19:15:09.173
Modified: 2024-08-28T19:47:25.410
Link: CVE-2024-39717
Redhat
No data.