PT-2019-14231 · Kaseya · Kaseya Vsa

Ken Pyle · Publicado 2019-08-26 · Atualizado 2021-07-21 · CVE-2019-15506

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator (VSA) versions through 9.4.0.37

Description The issue concerns a critical information disclosure problem. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the "/DATAREPORTS" directory can be accessed for reports, including results from NMAP, Patch Status, and Active Directory domain metadata, allowing an attacker to collect and parse critical information. Multiple directories are affected.

Recommendations For versions through 9.4.0.37, as a temporary workaround, consider restricting access to sensitive directories such as "/DATAREPORTS" to minimize the risk of exploitation. Avoid using the affected web application until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-15506

Produtos afetados

Kaseya Vsa

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-15506 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15506 · Nota de Segurança
• http://dfdrconsulting.com/2019/cyber-security/cve-2019-15506-kaseya-vsa-critical-information-disclosure-unauthenticated-access · Nota
• http://help.kaseya.com/WebHelp/EN/RN/index.asp#VSAReleaseNotes.htm · Aviso do Fabricante