CVE-2015-6922
First published: Mon Feb 17 2020(Updated: )
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kaseya Virtual System Administrator | >=7.0.0.0<7.0.0.33 | |
| Kaseya Virtual System Administrator | >=8.0.0.0<8.0.0.23 | |
| Kaseya Virtual System Administrator | >=9.0.0.0<9.0.0.19 | |
| Kaseya Virtual System Administrator | >=9.1.0.0<9.1.0.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html
- http://www.zerodayinitiative.com/advisories/ZDI-15-448
- http://www.zerodayinitiative.com/advisories/ZDI-15-449
- https://helpdesk.kaseya.com/entries/96164487--Kaseya-Security-Advisory
- https://www.exploit-db.com/exploits/38351/
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/kaseya
- canonical/kaseya virtual system administrator
- version/kaseya virtual system administrator/7.0.0.0
- version/kaseya virtual system administrator/8.0.0.0
- version/kaseya virtual system administrator/9.0.0.0
- version/kaseya virtual system administrator/9.1.0.0