CVE-2021-30119

🗓️ 09 Jul 2021 13:20:58Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 145 Views🌐 WEB

CVE-2021-30119 Authenticated reflective XSS in HelpDeskTab/rcResults.as

Reporter	Title	Published	Views	Family All 17
Information Security Automation	Last Week’s Security news: PrintNightmare patches and Metasploit, Kaseya CVEs, Morgan Stanley Accellion FTA, Cisco BPA and WSA, Philips Vue PACS, CISA RVAs, Lazarus job offers	11 Jul 202120:52	–	avleonov
Information Security Automation	Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins	19 Jul 202116:29	–	avleonov
Circl	CVE-2021-30119	12 Jul 202112:51	–	circl
CNNVD	Kaseya VSA 跨站脚本漏洞	9 Jul 202100:00	–	cnnvd
CNVD	Kaseya VSA Cross-Site Scripting Vulnerability	13 Jul 202100:00	–	cnvd
Cvelist	CVE-2021-30119 Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6	9 Jul 202113:20	–	cvelist
EUVD	EUVD-2021-17059	7 Oct 202500:30	–	euvd
Tenable Nessus	Kaseya VSA < 9.5.7a Multiple Vulnerabilities	12 Jul 202100:00	–	nessus
NCSC	Vulnerabilities fixed in Kaseya Virtual System Administrator (VSA)	12 Jul 202100:00	–	ncsc
NVD	CVE-2021-30119	9 Jul 202114:15	–	nvd

NVD

Node

kaseya vsaRange<9.5.7-

Source	Link
csirt	www.csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
csirt	www.csirt.divd.nl/CVE-2021-30119
csirt	www.csirt.divd.nl/DIVD-2021-00011

Parameter	Position	Path	Description	CWE
result	query param	/HelpDeskTab/rcResults.asp	Authenticated reflective XSS via insecure reflection of the result parameter in rcResults.asp leading to script execution	CWE-79
FileName	query param	/done.asp	Authenticated reflective XSS via insecure reflection of the FileName parameter in done.asp causing script execution	CWE-79

21 Nov 2024 06:03Current

7.2High risk

Vulners AI Score7.2

CVSS 23.5

CVSS 3.15.4

EPSS0.22281