Description
The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Director | Versa / Director | >= 21.2.2, <= 21.2.2 | affected |
| Director | Versa / Director | >= 21.2.3 before 2024-06-21, < 21.2.3 before 2024-06-21 | affected |
| Director | Versa / Director | >= 22.1.1, <= 22.1.1 | affected |
| Director | Versa / Director | >= 22.1.2 before 2024-06-21, <= 22.1.2 before 2024-06-21 | affected |
| Director | Versa / Director | >= 22.1.3 before 2024-06-21, <= 22.1.3 before 2024-06-21 | affected |
| versa_director | versa-networks / versa_director | 21.2.2 | affected |
| versa_director | versa-networks / versa_director | 21.2.2 | affected |
| versa_director | versa-networks / versa_director | 21.2.2 | affected |
| versa_director | versa-networks / versa_director | 21.2.2 | affected |
| versa_director | versa-networks / versa_director | 21.2.2 | affected |
| versa_director | versa-networks / versa_director | >= 21.2.3, < 21.2.3_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 21.2.3, < 21.2.3_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 21.2.3, < 21.2.3_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 21.2.3, < 21.2.3_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 21.2.3, < 21.2.3_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | 22.1.1 | affected |
| versa_director | versa-networks / versa_director | 22.1.1 | affected |
| versa_director | versa-networks / versa_director | 22.1.1 | affected |
| versa_director | versa-networks / versa_director | 22.1.1 | affected |
| versa_director | versa-networks / versa_director | 22.1.1 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.2, < 22.1.2_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.2, < 22.1.2_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.2, < 22.1.2_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.2, < 22.1.2_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.2, < 22.1.2_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.3, < 22.1.3_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.3, < 22.1.3_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.3, < 22.1.3_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.3, < 22.1.3_2024-06-21 | affected |
| versa_director | versa-networks / versa_director | >= 22.1.3, < 22.1.3_2024-06-21 | affected |