Unscored severity · published Jul 20, 2015
CVE-2015-2862
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote…
–
CVSS
9.5%
EPSS
No
On KEV
Description
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
Virtual System Administrator · Kaseya
7.0 before 7.0.0.29; 8.0 before 8.0.0.18; 9.0 before 9.0.0.14; 9.1 before 9.1.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2862
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2862
Third Party Advisory
http://www.kb.cert.org/vuls/id/919604
More from Virtual System Administrator
9.8
CVE-2018-20753
Kaseya VSA Remote Code Execution Vulnerability
9.8
CVE-2015-6922
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which…
8.8
CVE-2015-6589
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before…
7.5
CVE-2019-15506
An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37
7.4
CVE-2017-12410
It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier…