Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
(Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6
Vulnerability Description
Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
N/A
Vulnerability Title
Kaseya VSA 代码注入漏洞
Vulnerability Description
Kaseya VSA是美国Kaseya公司的托管服务提供商 (MSP) 常用来管理客户网络的RMM（远程监控和管理）软件。 Kaseya VSA 存在代码注入漏洞，该漏洞源于Kaseya VSA在9.5.6之前版本存在本地文件包含。
CVSS Information
N/A
Vulnerability Type
N/A