Skip to content
feed: live
>_0dayNews
CVE Record
[ CRITICAL ]CVE-2017-18362

Kaseya VSA SQL Injection Vulnerability

ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.

cat cve-2017-18362.json
Vendor
Kaseya
Product
Virtual System/Server Administrator (VSA)
CVSS
9.8
EPSS (exploit probability)
86.8%
Status
kevransomware use
CISA patch-by (BOD 22-01)
Published
Source
https://nvd.nist.gov/vuln/detail/CVE-2017-18362

ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.

Added to CISA’s Known Exploited Vulnerabilities catalog on 2022-05-24. Required action per CISA: The impacted product is end-of-life and should be disconnected if still in use. Due date: 2022-06-14.

This is an auto-synced KEV catalog record pending a full 0dayNews write-up — see CISA’s KEV catalog and the NVD record linked above for primary sources.