Information disclosure in Versa Director - CVE-2024-45229
Published: September 23, 2024
Vulnerability identifier: #VU97638
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2024-45229
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Versa Networks
Affected software:
Versa Director
Versa Director
Detailed vulnerability description
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the REST API exposes authentication tokens of other currently logged-in users in an error message. A remote non-authenticated attacker can send a specially crafted HTTP request, obtain an authentication token and use it to invoke additional APIs on port 9183.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
How to mitigate CVE-2024-45229
Install updates from vendor's website.