CVE-2019-15506
First published: Mon Aug 26 2019(Updated: )
An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. There are a number of directories affected.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kaseya VSA Agent | <=9.4.0.37 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-15506?
CVE-2019-15506 has been classified as a critical information disclosure vulnerability.
How do I fix CVE-2019-15506?
To address CVE-2019-15506, it is essential to upgrade Kaseya VSA to a version higher than 9.4.0.37.
Who is affected by CVE-2019-15506?
CVE-2019-15506 affects users of Kaseya Virtual System Administrator versions up to and including 9.4.0.37.
What kind of attacks are possible with CVE-2019-15506?
An unauthenticated attacker can exploit CVE-2019-15506 to send crafted requests and download sensitive data from the web application.
Are there known exploits for CVE-2019-15506?
Yes, there are reports of exploits that leverage CVE-2019-15506 to gain unauthorized access to sensitive information.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/kaseya
- canonical/kaseya vsa agent
- version/kaseya vsa agent/9.4.0.37