CVE-2021-30116

🗓️ 09 Jul 2021 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1395 Views🌐 WEB

Kaseya VSA before 9.5.7 allows credential disclosure, exploited in the wild in July 202

Reporter	Title	Published	Views	Family All 38
ATTACKERKB	CVE-2021-30116	9 Jul 202100:00	–	attackerkb
Information Security Automation	Last Week’s Security news: PrintNightmare patches and Metasploit, Kaseya CVEs, Morgan Stanley Accellion FTA, Cisco BPA and WSA, Philips Vue PACS, CISA RVAs, Lazarus job offers	11 Jul 202120:52	–	avleonov
Information Security Automation	Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins	19 Jul 202116:29	–	avleonov
BDU FSTEC	The vulnerability of the software for remote monitoring and management of IT systems by Kaseya VSA, related to insufficient protection of registration data, allows a hacker to disclose sensitive information that should be protected.	17 Dec 202100:00	–	bdu_fstec
Circl	CVE-2021-30116	5 Jul 202110:55	–	circl
CISA KEV Catalog	Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability	3 Nov 202100:00	–	cisa_kev
CNNVD	Kaseya VSA 输入验证错误漏洞	5 Jul 202100:00	–	cnnvd
CNVD	Kaseya VSA Input Validation Error Vulnerability	6 Jul 202100:00	–	cnvd
Check Point Advisories	Kaseya VSA Remote Code Execution (CVE-2021-30116)	27 Dec 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-30116 Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6	9 Jul 202100:00	–	cvelist

NVD

Node

Source	Link
csirt	www.csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/
helpdesk	www.helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021
csirt	www.csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
secpod	www.secpod.com/blog/kaseya-vsa-zero-day-by-revil/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
un	query param	/dl.asp	Unauthenticated credential disclosure via GET parameters on the download page (/dl.asp) leads to leakage of credentials that can be used to obtain a sessionId.	CWE-522
pw	query param	/dl.asp	Unauthenticated credential disclosure via GET parameters on the download page (/dl.asp) leads to leakage of credentials that can be used to obtain a sessionId.	CWE-522

17 Jun 2026 03:49Current

9.2High risk

Vulners AI Score9.2

CVSS 27.5

CVSS 3.19.8 - 10

EPSS0.85735

SSVC