CVE-2019-15506: High severity kaseya vsa agent vulnerability
An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. There are a number of directories affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15506?
CVE-2019-15506 has been classified as a critical information disclosure vulnerability.
How do I fix CVE-2019-15506?
To address CVE-2019-15506, it is essential to upgrade Kaseya VSA to a version higher than 9.4.0.37.
Who is affected by CVE-2019-15506?
CVE-2019-15506 affects users of Kaseya Virtual System Administrator versions up to and including 9.4.0.37.
What kind of attacks are possible with CVE-2019-15506?
An unauthenticated attacker can exploit CVE-2019-15506 to send crafted requests and download sensitive data from the web application.
Are there known exploits for CVE-2019-15506?
Yes, there are reports of exploits that leverage CVE-2019-15506 to gain unauthorized access to sensitive information.