{"id":"CVE-2015-2862","aliases":["EUVD-2015-2950","GHSA-phcx-v584-666v"],"status":"published","title":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0...","description":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.09415,"percentile":0.95445,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2015-07-20T23:00:00Z","modified":"2026-06-17T00:24:53Z","exploits":[{"source":"exploitdb","id":"EDB-37621","title":"Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)","type":"webapps","platform":"windows","date":"2015-07-15","url":"https://www.exploit-db.com/exploits/37621"}],"products":[{"vendor":"kaseya","product":"virtual_system_administrator"}],"references":[{"url":"http://www.kb.cert.org/vuls/id/919604","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2862"},{"url":"https://github.com/advisories/GHSA-phcx-v584-666v"}],"sources":{"cve":[{"id":"CVE-2015-2862","description":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.","status":"published","published":"2015-07-20T23:00:00Z","modified":"2024-08-06T05:32:19.8Z","updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2015-2950","description":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.","status":"published","published":"2015-07-20T23:00:00Z","modified":"2024-08-06T05:32:19Z","updated_at":"2026-11-03T02:22:10.045369Z"}],"ghsa":[{"id":"GHSA-phcx-v584-666v","title":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0...","description":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.","status":"published","published":"2022-05-14T01:36:39Z","modified":"2023-02-02T05:03:57Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:51:45.334217Z"}],"nvd":[{"id":"CVE-2015-2862","description":"Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.","status":"published","published":"2015-07-20T23:59:01.037Z","modified":"2026-06-17T00:24:53.137Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:07.96297Z"}]}}