CVE-2021-30121: (Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-09 · updated 2026-06-17
Weakness: CWE-829

Description

Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118

Affected products

Kaseya Vsa: before 9.5.6 — fixed in 9.5.6

How to fix

Upgrade to a fixed version: Kaseya Vsa 9.5.6. Check the vendor advisory for mitigations.

References

https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
https://csirt.divd.nl/CVE-2021-30121
https://csirt.divd.nl/DIVD-2021-00011
https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/
https://csirt.divd.nl/CVE-2021-30121
https://csirt.divd.nl/DIVD-2021-00011

Get alerted when CVE-2021-30121 or the next vulnerability affects your stack