← CVE catalog

CVE-2024-39717

High CVSS 7.2 Known exploited

Published 2024-08-22 · last changed 2026-06-17 · added to CISA KEV 2024-08-23

This one is being exploited in the wild.

CISA added CVE-2024-39717 to the Known Exploited Vulnerabilities catalog on 2024-08-23. Federal agencies are required to remediate it on a deadline. If you have affected machines, this is the class of finding that moves ahead of the rest of the queue.

The fix

We hold no Microsoft remediation data for CVE-2024-39717, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

Sources

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H