PatchTheCVEkaseya vulnerabilities
Recent CVEs affecting kaseya products. 22 tracked.
kaseya has 22 tracked vulnerabilities, 10 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 22. Most recent: 2022-04-15. Highest priority: CVE-2021-30116 (score 100/100).
- CVE-2021-30120 CRITICAL 9.9 UPGRADE Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement
- CVE-2021-30119 MEDIUM 5.4 UPGRADE Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp i
- CVE-2021-30116 CRITICAL 10.0 EXPLOITED UPGRADE UPGRADE Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability
- CVE-2021-43044 CRITICAL 9.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43043 MEDIUM 6.5 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43042 CRITICAL 9.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43041 HIGH 8.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43040 HIGH 8.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43039 MEDIUM 6.5 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43038 HIGH 8.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43037 HIGH 7.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43036 CRITICAL 9.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43035 CRITICAL 9.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43034 HIGH 7.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-43033 CRITICAL 9.8 UPGRADE An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5
- CVE-2021-40387 HIGH 8.8 UPGRADE An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2
- CVE-2021-40386 CRITICAL 9.8 UPGRADE Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code.
- CVE-2021-40385 HIGH 8.8 UPGRADE An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2
- CVE-2021-30201 HIGH 7.5 UPGRADE The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system
- CVE-2021-30121 MEDIUM 6.5 UPGRADE Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Examp
- CVE-2021-30118 CRITICAL 9.8 UPGRADE An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monito
- CVE-2021-30117 CRITICAL 9.8 UPGRADE The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injectio
FAQ
How do I fix kaseya vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is kaseya being exploited right now?
Yes: 1 kaseya CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which kaseya CVE should I patch first?
CVE-2021-30116 currently ranks highest (100/100): Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability.