CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Sep 13, 2024

CVE-2024-39717

High

EPSS 4.6%CISA KEV

Versa/Director

Description

The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.

EPSS — Exploit Probability

4.6%

Higher than 89.1% of all CVEs

Required Action

https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2024-39717

Risk Assessment

ELEVATED

In CISA KEV

Details

Severity: High
EPSS: 4.6%
CISA KEV: Yes
Ransomware: Unknown
Articles: 0

Timeline

Published

Aug 23, 2024

Added to KEV

Aug 23, 2024

Remediation Due

Sep 13, 2024

Affected Product

Versa

Director

View all Versa CVEs

External Links

NVD (NIST)CVE Details MITRE CVE