Kaseya Left Customer Portal Vulnerable to 2015 Flaw in its Own Software

Summary: Kaseya's customer service portal, portal.kaseya.net, remained exposed to CVE-2015-2862, a directory traversal flaw in Kaseya VSA first identified in July 2015, until Mandiant notified the company on July 3, 2021. Kaseya executive vice president Michael Sanders said the portal had been retired in 2018 but was 'deprecated but left up,' and researcher Alex Holden said the live flaw did not require authentication as the CVE description states.
Bottom line: The same week REvil used CVE-2021-30116 to deploy ransomware to roughly 1,500 organizations, Kaseya's own portal was leaking a six-year-old flaw in its own software, and the company's license agreement caps aggregate liability at fees paid in the six months before a claim.

Read the original at Krebs on Security ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2015-2862 CVE-2021-30116
Related: CVE-2021-30116: Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Quarterly Report: Incident Response trends from Q3 2021 Cyber Risks ·
Kaseya REvil Ransomware Attack (CVE-2021-30116) – Automatically Discover and Prioritize Using Qualys VMDR® | Qualys Cyber Risks ·