high8.8Public exploit code
CVE-2015-6589
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (2)2015-09-29 · webapps · asp · Verified
- Kaseya Virtual System Administrator (VSA) 7.0 < 9.1 - (Authenticated) Arbitrary File Upload2015-09-28 · webapps · asp
Impact
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kaseya | Virtual System Administrator | from 7.0.0.0 before 7.0.0.33 from 8.0.0.0 before 8.0.0.23 from 9.0.0.0 before 9.0.0.19 from 9.1.0.0 before 9.1.0.9 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html
- http://www.zerodayinitiative.com/advisories/ZDI-15-450
- https://www.exploit-db.com/exploits/38351/
- https://www.securityfocus.com/bid/76838
- http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html
- http://www.zerodayinitiative.com/advisories/ZDI-15-450
- https://www.exploit-db.com/exploits/38351/
- https://www.securityfocus.com/bid/76838