CVEvulnerability
CVE-2015-6589
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-02-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-22
Description
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.
Affected configurations
• kaseya virtual system administrator (>= 7.0.0.0 < 7.0.0.33)
• kaseya virtual system administrator (>= 8.0.0.0 < 8.0.0.23)
• kaseya virtual system administrator (>= 9.0.0.0 < 9.0.0.19)
• kaseya virtual system administrator (>= 9.1.0.0 < 9.1.0.9)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-15-450 Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/38351/ Exploit, Third Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/76838 Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-15-450 Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/38351/ Exploit, Third Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/76838 Third Party Advisory, VDB Entry