(Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6
CVE-2021-30121

6.5MEDIUM

Key Information:

Vendor: Kaseya
Status: Vsa
Vendor: CVE Published:; 9 July 2021

🔔 Create Kaseya Vulnerability Alert

What is CVE-2021-30121?

Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp A valid sessionId is required but can be easily obtained via CVE-2021-30118

References

https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/

x_refsource_CONFIRM

https://csirt.divd.nl/DIVD-2021-00011

x_refsource_CONFIRM

https://csirt.divd.nl/CVE-2021-30121

x_refsource_CONFIRM

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 9, 2021
Vulnerability Reserved
Apr 2, 2021

Credit

Discovered by Wietse Boonstra of DIVD

Additional research by Frank Breedijk of DIVD

.