Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html | Exploit Third Party Advisory VDB Entry |
| http://www.zerodayinitiative.com/advisories/ZDI-15-450 | Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/38351/ | Exploit Third Party Advisory VDB Entry |
| https://www.securityfocus.com/bid/76838 | Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html | Exploit Third Party Advisory VDB Entry |
| http://www.zerodayinitiative.com/advisories/ZDI-15-450 | Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/38351/ | Exploit Third Party Advisory VDB Entry |
| https://www.securityfocus.com/bid/76838 | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://www.zerodayinitiative.com/advisories/ZDI-15-450 - Third Party Advisory, VDB Entry | |
| References | () https://www.exploit-db.com/exploits/38351/ - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.securityfocus.com/bid/76838 - Third Party Advisory, VDB Entry |
Information
Published : 2020-02-13 21:15
Updated : 2024-11-21 02:35
NVD link : CVE-2015-6589
Mitre link : CVE-2015-6589
CVE.ORG link : CVE-2015-6589
JSON object : View
Products Affected
kaseya
- virtual_system_administrator
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')