Live › vulnerability › CVE-2024-39717
Go to dashboardVersa Director's GUI lets administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges upload a file through the Change Favicon feature, which only checks for a .png extension. An attacker with those admin roles can upload a malicious file disguised as a PNG, and CISA lists this flaw as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Versa Director | vendor | – | – |
| versa-networks versa director | vendor | = 21.2.2 | – |
| versa-networks versa director | vendor | = 21.2.3 | – |
| versa-networks versa director | vendor | = 22.1.1 | – |
| versa-networks versa director | vendor | = 22.1.2 | – |
| versa-networks versa director | vendor | = 22.1.3 | – |
Unknown from the sources.
Apply the mitigation per Versa's vendor instructions, or discontinue use of the product if no mitigation is available (per CISA required action).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
This page as .md · .json · in your agent: get_signal("CVE-2024-39717")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.