PT-2019-14231 · Kaseya · Kaseya Vsa

Ken Pyle · Published 2019-08-26 · Updated 2021-07-21 · CVE-2019-15506

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kaseya Virtual System Administrator (VSA) versions through 9.4.0.37

Description The issue concerns a critical information disclosure problem. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the "/DATAREPORTS" directory can be accessed for reports, including results from NMAP, Patch Status, and Active Directory domain metadata, allowing an attacker to collect and parse critical information. Multiple directories are affected.

Recommendations For versions through 9.4.0.37, as a temporary workaround, consider restricting access to sensitive directories such as "/DATAREPORTS" to minimize the risk of exploitation. Avoid using the affected web application until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-15506

Affected Products

Kaseya Vsa

References · 4

• https://osv.dev/vulnerability/CVE-2019-15506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15506 · Security Note
• http://help.kaseya.com/WebHelp/EN/RN/index.asp#VSAReleaseNotes.htm · Vendor Advisory
• http://dfdrconsulting.com/2019/cyber-security/cve-2019-15506-kaseya-vsa-critical-information-disclosure-unauthenticated-access · Note