CVE-2024-39717

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Versa	Director	>= 21.2.2, <= 21.2.2; >= 21.2.3 before 2024-06-21, < 21.2.3 before 2024-06-21; >= 22.1.1, <= 22.1.1; >= 22.1.2 before 2024-06-21, <= 22.1.2 before 2024-06-21; >= 22.1.3 before 2024-06-21, <= 22.1.3 before 2024-06-21
versa-networks	versa_director	21.2.2; >= 21.2.3, < 21.2.3_2024-06-21; 22.1.1; >= 22.1.2, < 22.1.2_2024-06-21; >= 22.1.3, < 22.1.3_2024-06-21
versa-networks	versa_director	21.2.2; >= 21.2.3, < 21.2.3_2024-06-21; 22.1.1; >= 22.1.2, < 22.1.2_2024-06-21; >= 22.1.3, < 22.1.3_2024-06-21
versa-networks	versa_director	21.2.2; >= 21.2.3, < 21.2.3_2024-06-21; 22.1.1; >= 22.1.2, < 22.1.2_2024-06-21; >= 22.1.3, < 22.1.3_2024-06-21
versa-networks	versa_director	21.2.2; >= 21.2.3, < 21.2.3_2024-06-21; 22.1.1; >= 22.1.2, < 22.1.2_2024-06-21; >= 22.1.3, < 22.1.3_2024-06-21
versa-networks	versa_director	21.2.2; >= 21.2.3, < 21.2.3_2024-06-21; 22.1.1; >= 22.1.2, < 22.1.2_2024-06-21; >= 22.1.3, < 22.1.3_2024-06-21

References

Timeline

Published: Aug 22, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Aug 23, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-397188.1An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equival CVE-2024-397197.5An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route wit CVE-2024-39724.3The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which CVE-2024-397208.2An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 byt CVE-2024-397217.5An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path CVE-2024-397227.5An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in th CVE-2024-397234.6IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the sys CVE-2024-397245.3IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocat CVE-2024-397255.3IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information CVE-2024-397268.2IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack CVE-2024-397279.8IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site.CVE-2024-397285.4IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to