PatchTheCVEvsa vulnerabilities and fixes
Recent CVEs affecting vsa, with upgrade or downgrade steps. 6 tracked.
vsa has 6 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 6. Most recent: 2021-07-09. Highest priority: CVE-2021-30118 (score 69/100).
- CVE-2021-30120 CRITICAL 9.9 UPGRADE Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement
- CVE-2021-30119 MEDIUM 5.4 UPGRADE Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp i
- CVE-2021-30201 HIGH 7.5 UPGRADE The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system
- CVE-2021-30121 MEDIUM 6.5 UPGRADE Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Examp
- CVE-2021-30118 CRITICAL 9.8 UPGRADE An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monito
- CVE-2021-30117 CRITICAL 9.8 UPGRADE The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injectio
FAQ
How do I fix vsa vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vsa being exploited right now?
None of the tracked vsa CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vsa CVE should I patch first?
CVE-2021-30118 currently ranks highest (69/100): An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monito.