CVE-2015-6922

Katalog CVE

CVSS 9.8 · Critical EPSS 82,1%

Kerentanan Improper Authentication pada kaseya virtual system administrator. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx.

Rincian

Terbit di NVD

17 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

82,1% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://helpdesk.kaseya.com/entries/96164487--Kaseya-Security-Advisory broken link · advisory vendor
• http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escal... exploit · advisory pihak ketiga · vdb entry
• http://www.zerodayinitiative.com/advisories/ZDI-15-448 advisory pihak ketiga · vdb entry
• http://www.zerodayinitiative.com/advisories/ZDI-15-449 advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/38351/ exploit · advisory pihak ketiga · vdb entry