CVE-2021-30119

Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`
References
Link Resource
https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ Patch Third Party Advisory
https://csirt.divd.nl/CVE-2021-30119 Exploit Third Party Advisory
https://csirt.divd.nl/DIVD-2021-00011 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:kaseya:vsa:*:*:*:*:-:*:*:*

History

29 Apr 2022, 18:15

Type Values Removed Values Added
References (MISC) https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ - Third Party Advisory (MISC) https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ - Patch, Third Party Advisory
References (CONFIRM) https://csirt.divd.nl/DIVD-2021-00011 - Third Party Advisory (CONFIRM) https://csirt.divd.nl/DIVD-2021-00011 - Patch, Third Party Advisory
References (CONFIRM) https://csirt.divd.nl/CVE-2021-30119 - Third Party Advisory (CONFIRM) https://csirt.divd.nl/CVE-2021-30119 - Exploit, Third Party Advisory

04 Apr 2022, 07:15

Type Values Removed Values Added
Summary Cross Site Scripting (XSS) exists in Kaseya VSA before 9.5.7. Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`

01 Mar 2022, 19:01

Type Values Removed Values Added
References (CONFIRM) https://csirt.divd.nl/DIVD-2021-00011 - (CONFIRM) https://csirt.divd.nl/DIVD-2021-00011 - Third Party Advisory
References (CONFIRM) https://csirt.divd.nl/CVE-2021-30119 - (CONFIRM) https://csirt.divd.nl/CVE-2021-30119 - Third Party Advisory

07 Feb 2022, 16:15

Type Values Removed Values Added
References
  • (CONFIRM) https://csirt.divd.nl/DIVD-2021-00011 -
  • (CONFIRM) https://csirt.divd.nl/CVE-2021-30119 -

12 Jul 2021, 16:36

Type Values Removed Values Added
CWE CWE-79
References (MISC) https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ - (MISC) https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ - Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 3.5
v3 : 5.4
CPE cpe:2.3:a:kaseya:vsa:*:*:*:*:-:*:*:*

09 Jul 2021, 15:01

Type Values Removed Values Added
New CVE

Information

Published : 2021-07-09 14:15

Updated : 2023-12-10 13:55


NVD link : CVE-2021-30119

Mitre link : CVE-2021-30119

CVE.ORG link : CVE-2021-30119


JSON object : View

Products Affected

kaseya

  • vsa
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')