github - ghsa-q2pv-h46f-8gvc

ghsa-q2pv-h46f-8gvc

Vulnerability from github

Published

2024-09-20 21:31

Modified

2024-09-20 21:31

Severity ?

6.6 (Medium) - CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

Currently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API. /vnms/devicereg/device/ (on ports 9182 & 9183) and /versa/vnms/devicereg/device/ (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-45229"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-20T19:15:16Z",
    "severity": "MODERATE"
  },
  "details": "The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information. \n\nCurrently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API.  /vnms/devicereg/device/* (on ports 9182 \u0026 9183) and /versa/vnms/devicereg/device/* (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance.",
  "id": "GHSA-q2pv-h46f-8gvc",
  "modified": "2024-09-20T21:31:39Z",
  "published": "2024-09-20T21:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45229"
    },
    {
      "type": "WEB",
      "url": "https://security-portal.versa-networks.com/emailbulletins/66e4a8ebda545d61ec2b1ab9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-45229

Vulnerability from cvelistv5

Published

2024-09-20 18:09

Modified

2024-09-20 18:53

Severity ?

6.6 (Medium) - CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information. Currently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API. /vnms/devicereg/device/* (on ports 9182 & 9183) and /versa/vnms/devicereg/device/* (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance.

References

▼	URL	Tags
	https://security-portal.versa-networks.com/emailbulletins/66e4a8ebda545d61ec2b1ab9

Impacted products

Vendor

Product

Version

▼

Versa

Director

Version: 22.1.4 20240909   < 22.1.4 20240909
Version: 22.1.3 20240909   < 22.1.3 20240909
Version: 22.1.2 20240909   < 22.1.2 20240909
Version: 22.1.1 20240909   < 22.1.1 20240909
Version: 21.2.3 20240909   < 21.2.3 20240909
Version: 21.2.2 20240909   < 21.2.2 20240909

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:versa:director:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "director",
            "vendor": "versa",
            "versions": [
              {
                "status": "affected",
                "version": "22.1.4"
              },
              {
                "status": "affected",
                "version": "22.1.3"
              },
              {
                "status": "affected",
                "version": "22.1.2"
              },
              {
                "status": "affected",
                "version": "22.1.1"
              },
              {
                "status": "affected",
                "version": "21.2.3"
              },
              {
                "status": "affected",
                "version": "21.2.2"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45229",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T18:45:34.826535Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-306",
                "description": "CWE-306 Missing Authentication for Critical Function",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T18:53:08.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Director",
          "vendor": "Versa",
          "versions": [
            {
              "lessThan": "22.1.4 20240909",
              "status": "affected",
              "version": "22.1.4 20240909",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.3 20240909",
              "status": "affected",
              "version": "22.1.3 20240909",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.2 20240909",
              "status": "affected",
              "version": "22.1.2 20240909",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.1 20240909",
              "status": "affected",
              "version": "22.1.1 20240909",
              "versionType": "custom"
            },
            {
              "lessThan": "21.2.3 20240909",
              "status": "affected",
              "version": "21.2.3 20240909",
              "versionType": "custom"
            },
            {
              "lessThan": "21.2.2 20240909",
              "status": "affected",
              "version": "21.2.2 20240909",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information. \r\n\r\nCurrently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API.  /vnms/devicereg/device/* (on ports 9182 \u0026 9183) and /versa/vnms/devicereg/device/* (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-20T18:09:30.570Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://security-portal.versa-networks.com/emailbulletins/66e4a8ebda545d61ec2b1ab9"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-45229",
    "datePublished": "2024-09-20T18:09:30.570Z",
    "dateReserved": "2024-08-24T01:00:01.733Z",
    "dateUpdated": "2024-09-20T18:53:08.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted