CVEvulnerability

CVE-2015-6922

9.8 CRITICAL Published 2020-02-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-02-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287

Description

Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx.

Affected configurations

• kaseya virtual system administrator (>= 7.0.0.0 < 7.0.0.33) • kaseya virtual system administrator (>= 8.0.0.0 < 8.0.0.23) • kaseya virtual system administrator (>= 9.0.0.0 < 9.0.0.19) • kaseya virtual system administrator (>= 9.1.0.0 < 9.1.0.9)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References