CVE-2024-39717mediumunder attackCWE-434

CVE-2024-39717: medium-severity vulnerability in Versa Director

Published · Updated

Follow this CVE+ Monitor Director

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.6epss 4.0%
from disclosure to weapon
Published on NVDAug 22
CISA KEV+1d
Action required by CISAfederal deadline: 2024-09-13

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

An authenticated administrator in Versa Director can upload a malicious file disguised as a PNG image through the favicon customization feature, potentially leading to unauthorized code execution or system compromise.

Technical detail

CWE-434 unrestricted file upload vulnerability in the favicon upload functionality allows authenticated Provider-Data-Center-Admin or Provider-Data-Center-System-Admin users to bypass file type validation by using .png extension on malicious payloads. Exploitation requires prior successful authentication and administrative privilege; impact includes potential remote code execution or system integrity violation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Versa · Director
Related CVEs — Versa Director

In the same product, most dangerous first.

CVE-2025-23172HIGHCVE-2025-23172EPSS 1.1%CVE-2024-45208CRITICALCVE-2024-45208EPSS 0.9%CVE-2025-23173HIGHCVE-2025-23173EPSS 0.6%CVE-2025-23170MEDIUMCVE-2025-23170EPSS 0.6%CVE-2024-42450CRITICALCVE-2024-42450EPSS 0.6%CVE-2025-23171HIGHCVE-2025-23171EPSS 0.6%