Log in Start free

Vulnerability · Published Jul 9, 2021 · Assigned by mitre

CVE-2021-30121(Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6

Medium 6.5

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.0% (higher than 92% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)5.0%top 7.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References