CVE-2021-30121

(Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6

Medium · published July 9, 2021

CVSS v3.1
6.5
EPSS
5%
Percentile
92.2
In the wild
Unconfirmed
What it is

Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.04962 · 92.2th percentile
Published
2021-07-09T13:24Z
EPSS history
Timeline
  • 09 JUL 13:24Z
    (Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6
    cvelistv5