CVE-2021-30121

概要

参考情報

• csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure · Patch
• csirt.divd.nl/CVE-2021-30121 · Exploit
• csirt.divd.nl/DIVD-2021-00011 · Patch

vsa のその他の脆弱性

• CVE-2021-30201高 7.5The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processe…
• CVE-2021-30120高 7.5Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instea…
• CVE-2021-30119中 5.4Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the r…
• CVE-2021-30118緊急 9.8An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.…
• CVE-2021-30117高 8.8The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Det…