CVE-2015-6922

🗓️ 17 Feb 2020 18:00:30Reported by mitreType

cve🔗 web.nvd.nist.gov👁 56 Views🌐 WEB

Kaseya VSA 7.x/8.x/9.x before 9.1.0.9 allows unauthenticated bypass to add admin account or execute arbitrary files

Reporter	Title	Published	Views	Family All 20
0day.today	Kaseya Virtual System Administrator - Multiple Vulnerabilities	29 Sep 201500:00	–	zdt
0day.today	Kaseya VSA uploader.aspx Arbitrary File Upload Exploit	3 Oct 201500:00	–	zdt
Circl	CVE-2015-6922	29 Sep 201500:00	–	circl
CNVD	Kaseya Virtual System Administrator Elevation of Privilege Vulnerability	27 Sep 201500:00	–	cnvd
Check Point Advisories	Kaseya Virtual System Administrator Multiple Vulnerabilities (CVE-2015-6922)	22 Sep 201600:00	–	checkpoint_advisories
Cvelist	CVE-2015-6922	17 Feb 202018:00	–	cvelist
Exploit DB	Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (2)	29 Sep 201500:00	–	exploitdb
Exploit DB	Kaseya Virtual System Administrator (VSA) - 'uploader.aspx' Arbitrary File Upload (Metasploit)	5 Oct 201500:00	–	exploitdb
Exploit DB	Kaseya Virtual System Administrator (VSA) 7.0 < 9.1 - (Authenticated) Arbitrary File Upload	28 Sep 201500:00	–	exploitdb
exploitpack	Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (2)	29 Sep 201500:00	–	exploitpack

NVD

Node

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-15-449
helpdesk	www.helpdesk.kaseya.com/entries/96164487--Kaseya-Security-Advisory
packetstormsecurity	www.packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html
exploit-db	www.exploit-db.com/exploits/38351/
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-15-448

Parameter	Position	Path	Description	CWE
sessionVal	request body	LocalAuth/setAccount.aspx	Unauthenticated remote privilege escalation via adding a Master Administrator account.	CWE-287
adminName	request body	LocalAuth/setAccount.aspx	Unauthenticated remote privilege escalation via adding a Master Administrator account.	CWE-287
NewPassword	request body	LocalAuth/setAccount.aspx	Unauthenticated remote privilege escalation via adding a Master Administrator account.	CWE-287
confirm	request body	LocalAuth/setAccount.aspx	Unauthenticated remote privilege escalation via adding a Master Administrator account.	CWE-287
adminEmail	request body	LocalAuth/setAccount.aspx	Unauthenticated remote privilege escalation via adding a Master Administrator account.	CWE-287
setAccount	request body	LocalAuth/setAccount.aspx	Unauthenticated remote privilege escalation via adding a Master Administrator account.	CWE-287
PathData	query param	ConfigTab/uploader.aspx	Unauthenticated remote code execution via file upload with directory traversal.	CWE-287
qqfile	query param	ConfigTab/uploader.aspx	Unauthenticated remote code execution via file upload with directory traversal.	CWE-287
directory	request body	vsapres/web20/json.ashx	Authenticated remote code execution via file upload to WebPages path using multipart/form-data.	CWE-287
ReferringWebWindowId	request body	vsapres/web20/json.ashx	Authenticated remote code execution via file upload to WebPages path using multipart/form-data.	CWE-287

17 Jun 2026 00:31Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.82102