CVE-2015-6922

🗓️ 17 Feb 2020 18:00:30Reported by mitreType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Kaseya VSA 7.x/8.x/9.x before 9.1.0.9 allows unauthenticated bypass to add admin account or execute arbitrary files

Reporter	Title	Published	Views	Family All 20
0day.today	Kaseya Virtual System Administrator - Multiple Vulnerabilities	29 Sep 201500:00	–	zdt
0day.today	Kaseya VSA uploader.aspx Arbitrary File Upload Exploit	3 Oct 201500:00	–	zdt
Circl	CVE-2015-6922	29 Sep 201500:00	–	circl
CNVD	Kaseya Virtual System Administrator Elevation of Privilege Vulnerability	27 Sep 201500:00	–	cnvd
Check Point Advisories	Kaseya Virtual System Administrator Multiple Vulnerabilities (CVE-2015-6922)	22 Sep 201600:00	–	checkpoint_advisories
Cvelist	CVE-2015-6922	17 Feb 202018:00	–	cvelist
Exploit DB	Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (2)	29 Sep 201500:00	–	exploitdb
Exploit DB	Kaseya Virtual System Administrator (VSA) - 'uploader.aspx' Arbitrary File Upload (Metasploit)	5 Oct 201500:00	–	exploitdb
Exploit DB	Kaseya Virtual System Administrator (VSA) 7.0 < 9.1 - (Authenticated) Arbitrary File Upload	28 Sep 201500:00	–	exploitdb
exploitpack	Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (2)	29 Sep 201500:00	–	exploitpack

NVD

Node

kaseya virtual_system_administratorRange7.0.0.0–7.0.0.33

kaseya virtual_system_administratorRange8.0.0.0–8.0.0.23

kaseya virtual_system_administratorRange9.0.0.0–9.0.0.19

kaseya virtual_system_administratorRange9.1.0.0–9.1.0.9

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-15-449
helpdesk	www.helpdesk.kaseya.com/entries/96164487--Kaseya-Security-Advisory
packetstormsecurity	www.packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html
exploit-db	www.exploit-db.com/exploits/38351/
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-15-448

Parameter	Position	Path	Description	CWE
sessionVal	request body	LocalAuth/setAccount.aspx	Remote privilege escalation: create a Master Administrator account via unauthenticated POST to LocalAuth/setAccount.aspx	CWE-287
adminName	request body	LocalAuth/setAccount.aspx	Remote privilege escalation: create a Master Administrator account via unauthenticated POST to LocalAuth/setAccount.aspx	CWE-287
NewPassword	request body	LocalAuth/setAccount.aspx	Remote privilege escalation: create a Master Administrator account via unauthenticated POST to LocalAuth/setAccount.aspx	CWE-287
confirm	request body	LocalAuth/setAccount.aspx	Remote privilege escalation: create a Master Administrator account via unauthenticated POST to LocalAuth/setAccount.aspx	CWE-287
adminEmail	request body	LocalAuth/setAccount.aspx	Remote privilege escalation: create a Master Administrator account via unauthenticated POST to LocalAuth/setAccount.aspx	CWE-287
setAccount	request body	LocalAuth/setAccount.aspx	Remote privilege escalation: create a Master Administrator account via unauthenticated POST to LocalAuth/setAccount.aspx	CWE-287
PathData	query param	ConfigTab/uploader.aspx	Remote code execution via file upload with directory traversal (unauthenticated) using uploader.aspx	CWE-287
qqfile	query param	ConfigTab/uploader.aspx	Remote code execution via file upload with directory traversal (unauthenticated) using uploader.aspx	CWE-287
directory	upload data	vsapres/web20/json.ashx	Remote code execution via file upload with directory traversal (authenticated) using json.ashx uploadFile path	CWE-287
ReferringWebWindowId	upload data	vsapres/web20/json.ashx	Remote code execution via file upload with directory traversal (authenticated) using json.ashx uploadFile path	CWE-287

21 Nov 2024 02:35Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.77795

CWE-287