CVE-2024-39717
Published 2024-08-22 · Updated 2026-06-17 · Source support@hackerone.com
Summary
CVE-2024-39717 is a high-severity (CVSS 7.2) vulnerability in Versa Director. CISA added it to the Known Exploited Vulnerabilities catalog on August 23, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 13, 2024. CISA does not currently list it as used in ransomware campaigns. Versa has 2 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 2 known-exploited Versa vulnerabilities →Description
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Versa — Director
Name: Versa Director Dangerous File Type Upload Vulnerability
Date added: 2024-08-23 · Due: 2024-09-13
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.