CVE-2021-30120

Katalog CVE

CVSS 7.5 · High EPSS 5,7%

Kerentanan Incorrect Resource Transfer Between Spheres pada kaseya vsa. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.

Rincian

Terbit di NVD

9 Juli 2021

Terakhir diubah

14 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-669: Incorrect Resource Transfer Between Spheres

EPSS (30 hari)

5,7% peluang dieksploitasi; lebih tinggi dari 92,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ patch · advisory pihak ketiga
• https://csrit.divd.nl/CVE-2021-30120 permissions required · advisory pihak ketiga
• https://csrit.divd.nl/DIVD-2021-00011 permissions required · advisory pihak ketiga