{"api_version":"1","generated_at":"2026-07-23T11:47:01+00:00","cve":"CVE-2015-6589","urls":{"html":"https://cve.report/CVE-2015-6589","api":"https://cve.report/api/cve/CVE-2015-6589.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-6589","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-6589"},"summary":{"title":"CVE-2015-6589","description":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2020-02-13 21:15:00","updated_at":"2020-02-25 18:32:00"},"problem_types":["CWE-22"],"metrics":[],"references":[{"url":"https://www.securityfocus.com/bid/76838","name":"https://www.securityfocus.com/bid/76838","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"Kaseya Virtual System Administrator CVE-2015-6589 Arbitrary File Upload Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html","name":"http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"Kaseya Virtual System Administrator Code Execution / Privilege Escalation ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/38351/","name":"https://www.exploit-db.com/exploits/38351/","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (2) - ASP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-15-450","name":"http://www.zerodayinitiative.com/advisories/ZDI-15-450","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6589","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6589","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"6589","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kaseya","cpe5":"virtual_system_administrator","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6589","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kaseya","cpe5":"virtual_system_administrator","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-6589","STATE":"PUBLIC"},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"references":{"reference_data":[{"refsource":"MISC","name":"http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html","url":"http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html"},{"refsource":"MISC","name":"http://www.zerodayinitiative.com/advisories/ZDI-15-450","url":"http://www.zerodayinitiative.com/advisories/ZDI-15-450"},{"refsource":"MISC","name":"https://www.exploit-db.com/exploits/38351/","url":"https://www.exploit-db.com/exploits/38351/"},{"refsource":"MISC","name":"https://www.securityfocus.com/bid/76838","url":"https://www.securityfocus.com/bid/76838"}]}},"nvd":{"publishedDate":"2020-02-13 21:15:00","lastModifiedDate":"2020-02-25 18:32:00","problem_types":["CWE-22"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*","versionStartIncluding":"9.1.0.0","versionEndExcluding":"9.1.0.9","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0.0","versionEndExcluding":"9.0.0.19","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0.0","versionEndExcluding":"8.0.0.23","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0.0","versionEndExcluding":"7.0.0.33","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"6589","Ordinal":"83590","Title":"CVE-2015-6589","CVE":"CVE-2015-6589","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"6589","Ordinal":"1","NoteData":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.","Type":"Description","Title":null},{"CveYear":"2015","CveId":"6589","Ordinal":"2","NoteData":"2020-02-13","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"6589","Ordinal":"3","NoteData":"2020-02-13","Type":"Other","Title":"Modified"}]}}}