#VU97638 Information disclosure in Versa Director - CVE-2024-45229
Published: September 23, 2024
Vulnerability identifier: #VU97638
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2024-45229
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Versa Director
Versa Director
Software vendor:
Versa Networks
Versa Networks
Description
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the REST API exposes authentication tokens of other currently logged-in users in an error message. A remote non-authenticated attacker can send a specially crafted HTTP request, obtain an authentication token and use it to invoke additional APIs on port 9183.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
Remediation
Install updates from vendor's website.