CVE-2024-39717 - CVE House
Back to Database
Status published Medium CVE-2024-39717

The Versa Director GUI provides an option to customize the...

Vulnerability Description

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-39717

Credits & Attribution

No credits recorded in the NVD database.

References

More from Versa

View All →
CVE-2025-34027
Versa Concerto Authentication Bypass File Write Remote Code Execution
Critical 10
CVE-2025-34026
Versa Concerto Actuator Authentication Bypass Information Leak
Critical 9.2
CVE-2025-34025
Versa Concerto Insecure Docker Mount Container Escape
High 8.6
CVE-2025-24291
The Versa Director SD-WAN orchestration platform provides functionality to upload...
Medium 6.1
CVE-2025-24288
The Versa Director software exposes a number of services by...
Critical 9.8

Affected Vendor

Affected Software

Director
Vulnerable Versions:
21.2.2, 21.2.3 before 2024-06-21, 22.1.1, 22.1.2 before 2024-06-21, 22.1.3 before 2024-06-21

Timeline

Official Publish: August 22nd, 2024
Last Modified: October 21st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.