Versa Director Dangerous File Type Upload Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 23/08/2024. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| versa director | = 21.2.2= 21.2.3= 22.1.1= 22.1.2= 22.1.3 |
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free