CVE-2019-15506 is a critical information disclosure vulnerability affecting Kaseya Virtual System Administrator (VSA) versions up to 9.4.0.37. An unauthenticated attacker can exploit this flaw by sending specially crafted requests to the web application, allowing them to download sensitive files and information, such as reports containing NMAP scans, patch statuses, and Active Directory metadata. This vulnerability carries a CVSS score of 7.5 (High), indicating a high impact on confidentiality with no authentication or user interaction required. While no public exploits or Metasploit modules are currently available, and community discussion is minimal, the potential for unauthenticated data exfiltration makes this a significant risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.4.0.37CPE matchmatch criteria | cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.