Log in Start free

Actively exploited · Published Jul 9, 2021 · Assigned by mitre

CVE-2021-30119Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6

Medium 5.4

In plain English

A medium-severity security flaw in the affected software. CISA's analysis reports active exploitation. The chance it is exploited in the next 30 days is estimated at 58.8% (higher than 99.1% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)58.8%top 0.9% of all CVEs
Exploited in the wildYesCISA SSVC: active
Attack toolingNoneno public tooling known

Official description

Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References