Description (CNA)
Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
- https://csirt.divd.nl/DIVD-2021-00011
- https://csirt.divd.nl/CVE-2021-30121
ADP enrichment
No English description supplied.