CVE-2024-45229: Medium severity Versa Versa Director vulnerability
The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information. Currently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API. /vnms/devicereg/device/ (on ports 9182 & 9183) and /versa/vnms/devicereg/device/ (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45229?
CVE-2024-45229 is classified as a high severity vulnerability due to its potential for exploitation via unauthenticated APIs.
What components are affected by CVE-2024-45229?
CVE-2024-45229 affects the Versa Director software, specifically its REST APIs that do not require authentication.
How do I fix CVE-2024-45229?
To mitigate CVE-2024-45229, ensure that the Versa Director is not directly exposed to the Internet and implement proper authentication mechanisms for all APIs.
What kind of attacks can CVE-2024-45229 facilitate?
CVE-2024-45229 can facilitate unauthorized access and potential manipulation of devices managed by the Versa Director if exploited.
Is there a patch available for CVE-2024-45229?
As of now, check with Versa Networks for any available patches or updates addressing CVE-2024-45229.