Skip to content
OpenAdvisories
Critical VA-24-325-01 1 CVE

Versa Networks Versa Director insecure default PostgreSQL configuration

Published Nov 20, 2024 · Updated Nov 20, 2024 · Revision 2

Summary

Versa Networks Versa Director, by default, configures PostgreSQL to listen on all network interfaces using database credentials shared by multiple installations. From [Advising Vulnerability In Versa Director](https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3): "This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system.... Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors." The advisory does not directly address the "...common password across all instances of Versa Director."

Vulnerabilities 1

  • Critical 10.0

    The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High A…

Revision history

  1. #1.0.1

    Added Recommended Practices and document language

  2. #1.0.0

    Initial publication