Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2024-45229The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display,…

Description

The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information. Currently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API. /vnms/devicereg/device/* (on ports 9182 & 9183) and /versa/vnms/devicereg/device/* (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance.

Timeline

  1. ID reserved

    By hackerone

  2. · 27 days later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-45229, by who scored it
Scored byCVSSScoreVector
hackeroneCNA (assigner)3.0Medium6.6CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.0Medium6.6CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.51% · top 56% of all CVEs (14 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.6.

Affected products

  • Versa · Director

    • affected 22.1.4 20240909 – < 22.1.4 20240909
    • affected 22.1.3 20240909 – < 22.1.3 20240909
    • affected 22.1.2 20240909 – < 22.1.2 20240909
    • affected 22.1.1 20240909 – < 22.1.1 20240909
    • affected 21.2.3 20240909 – < 21.2.3 20240909
    • affected 21.2.2 20240909 – < 21.2.2 20240909

References

References1

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-45229 badge
[![CVE-2024-45229](https://cveledger.app/badge/CVE-2024-45229.svg)](https://cveledger.app/cve/CVE-2024-45229)

Record last updated .