csirt.divd.nlConfirmation
https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure CVE-2021-30119
MEDIUMRansomware
Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6
Record summary
CVE-2021-30119 has a selected CVSS score of 5.4 (medium). VulnCheck reports CVE-2021-30119 use in known ransomware campaigns.
Description
Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Jul 6, 2021 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
- Ransomware use
- Observed · VulnCheck
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| VulnCheck | Version data not supplied | ||
References
4csirt.divd.nlConfirmation
https://csirt.divd.nl/CVE-2021-30119 csirt.divd.nlConfirmation
https://csirt.divd.nl/DIVD-2021-00011 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-30119