Versa Director Dangerous File Type Upload Vulnerability

A remote attacker, with administrative privileges, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2024-09-13 under CISA BOD 22-01.

This is a Unrestricted File Upload (CWE-434) vulnerability in Versa Director. The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in. Exploitation requires remote network access, low attack complexity, an administrative account, and no user interaction required.

Probably yes if any of these apply:

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2024-08-23 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2024-09-13.