CVE-2017-18362 — Kaseya VSA SQL Injection Vulnerability
CVE-2017-18362: Kaseya VSA SQL Injection Vulnerability
CISA Known Exploited Vulnerability (KEV)
| Vendor / project | Kaseya |
| Product | Virtual System/Server Administrator (VSA) |
| Date added | 2022-05-24 |
| Due date | 2022-06-14 |
| Ransomware campaign use | Known |
Description
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
Required action (CISA)
The impacted product is end-of-life and should be disconnected if still in use.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2017-18362
Weakness behind it
CISA records this vulnerability as an instance of CWE-89. From there the chain continues into CAPEC attack patterns and ATT&CK techniques, all inside this corpus.
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-18362
- KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
See all 1,745 pages under Vulnerabilities (CVE) →
Related pages
Browse by topic
Every page in the corpus, grouped. Search finds one page; this shows what else is here.