CVE-2024-45229

MediumCVSS 6.6

Published: 20/09/2024(UTC)Updated: 25/08/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

41th percentile - higher than 41% of all known CVEs

Summary

Versa Director offers REST APIs for orchestration and management. Some APIs, such as login screen, banner display, and device registration, do not require authentication. It was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing authentication tokens of other logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose usernames or passwords.

Risk Assessment

Exposure of authentication tokens could allow an attacker to hijack sessions of logged-in users and access sensitive management functions, potentially leading to system compromise.

Recommendation

Upgrade Versa Director to remediated versions. If possible, use WAF or API Gateway to block access to vulnerable URLs.

Other vulnerabilities in Versa Director

CVE-2019-25029Critical
In Versa Director, a command injection vulnerability was detected that allows execution of arbitrary commands on the host operating system via a vulnerable application. The attack is possible when the application passes unsafe user-supplied data to a system shell, largely due to insufficient input validation.

Original NVD description (English source)

The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information. Currently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API. /vnms/devicereg/device/* (on ports 9182 & 9183) and /versa/vnms/devicereg/device/* (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance.