CVE-2024-45229

🗓️ 20 Sep 2024 18:09:30Reported by hackeroneType

cve🔗 web.nvd.nist.gov👁 110 Views🌐 WEB

Versa Director allows unauthenticated access to certain APIs, potentially exposing authentication tokens and allowing for additional API invocation

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the software platform interface for managing network infrastructure, Versa Director, allows a perpetrator to disclose protected information.	22 Jan 202500:00	–	bdu_fstec
Circl	CVE-2024-45229	20 Sep 202422:15	–	circl
CISA	Versa Networks Releases Advisory for a Vulnerability in Versa Director, CVE-2024-45229	20 Sep 202412:00	–	cisa
CNNVD	Versa Director 安全漏洞	20 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-45229	20 Sep 202418:09	–	cvelist
EUVD	EUVD-2024-41374	3 Oct 202520:07	–	euvd
NVD	CVE-2024-45229	20 Sep 202419:15	–	nvd
Positive Technologies	PT-2024-10235 · Versa · Versa Director	24 Aug 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-45229	23 May 202508:07	–	redhatcve
Vulnrichment	CVE-2024-45229	20 Sep 202418:09	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

versa-networks versa_directorMatch21.2.2

versa-networks versa_directorMatch21.2.3-

versa-networks versa_directorMatch22.1.1

versa-networks versa_directorMatch22.1.2-

versa-networks versa_directorMatch22.1.3-

versa-networks versa_directorMatch22.1.4-

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Versa",
    "product": "Director",
    "versions": [
      {
        "version": "22.1.4 20240909",
        "status": "affected",
        "lessThan": "22.1.4 20240909",
        "versionType": "custom"
      },
      {
        "version": "22.1.3 20240909",
        "status": "affected",
        "lessThan": "22.1.3 20240909",
        "versionType": "custom"
      },
      {
        "version": "22.1.2 20240909",
        "status": "affected",
        "lessThan": "22.1.2 20240909",
        "versionType": "custom"
      },
      {
        "version": "22.1.1 20240909",
        "status": "affected",
        "lessThan": "22.1.1 20240909",
        "versionType": "custom"
      },
      {
        "version": "21.2.3 20240909",
        "status": "affected",
        "lessThan": "21.2.3 20240909",
        "versionType": "custom"
      },
      {
        "version": "21.2.2 20240909",
        "status": "affected",
        "lessThan": "21.2.2 20240909",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
security-portal	www.security-portal.versa-networks.com/emailbulletins/66e4a8ebda545d61ec2b1ab9

Parameter	Position	Path	Description	CWE
invalid arguments in GET request	query param	/vnms/devicereg/device/*	Exploitable GET request with invalid arguments may expose authentication tokens of other logged-in users on Internet-connected Versa Directors.	CWE-306
invalid arguments in GET request	query param	/versa/vnms/devicereg/device/*	Exploitable GET request with invalid arguments may expose authentication tokens of other logged-in users on Internet-connected Versa Directors.	CWE-306

25 Aug 2026 14:28Current

7.5High risk

Vulners AI Score7.5

CVSS 36.6

EPSS0.00509

SSVC

CWE-306