The Versa Director GUI provides an option to customize the look and feel of the user interface.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- Fix
- Fixed in 21.2.3 before 2024-06-21
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Versa Director GUI, a web-based management interface for Versa network software, is affected by a flaw in its "Change Favicon" customization option that allows a malicious file disguised with a .png extension to be uploaded. An attacker would need valid administrator credentials to reach this option, and successful abuse could lead to a harmful file being stored on the system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- Versa Director
From 21.2.2 · through 21.2.2; From 21.2.3 before 2024-06-21 · fixed in 21.2.3 before 2024-06-21; From 22.1.1 · through 22.1.1; From 22.1.2 before 2024-06-21 · through 22.1.2 before 2024-06-21; From 22.1.3 before 2024-06-21 · through 22.1.3 before 2024-06-21