Information Disclosure Vulnerability in Kaseya Virtual System Administrator
CVE-2019-15506

7.5HIGH

Key Information:

Vendor

Kaseya

Status
Virtual System Administrator
Vendor
CVE Published:
26 August 2019

What is CVE-2019-15506?

A vulnerability exists in Kaseya Virtual System Administrator (VSA) which allows an unauthenticated attacker to send specially crafted requests to the web application. This can lead to unauthorized access and download of sensitive files from the server, particularly from the /DATAREPORTS directory. The exposed reports may contain critical data such as NMAP results, patch status, and Active Directory metadata, making it easier for attackers to gather and exploit this information for malicious purposes.

References

http://help.kaseya.com/WebHelp/EN/RN/index.asp#VSARelease...
x_refsource_MISC
http://dfdrconsulting.com/2019/cyber-security/cve-2019-15...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.