CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2024-39717: Versa Director Dangerous File Type Upload Vulnerability

criticalknown exploitedCVE-2024-39717
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.

CSIRTS triage

vendor: Versaproduct: Versa DirectorOther
What
Versa Director has an unrestricted file upload vulnerability that allows malicious file uploads disguised as images.
Who is affected
Administrators with specific privileges on the Versa Director GUI.
Urgency
Immediate action is required due to active exploitation and critical severity.
Action
Implement restrictions on file uploads and update to the latest version.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Versa Director

Get an email when a new Versa Director advisory drops — max one per day, one-click unsubscribe.

Details

Source
CISA Known Exploited Vulnerabilities (US · database · site)
Severity
critical
Published
2024-08-23
Exploitation
Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39717

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2024-39717coverage & exploitation statusNVD · CVE.org

More from CISA Known Exploited Vulnerabilities