Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2017-18362 Details

Description

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18362 CISA-ADPUS Government Resource
http://archive.today/rdkeQ CVEThird Party Advisory
https://github.com/kbni/owlky CVEExploitThird Party Advisory
https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articles/360022495572-Connectwise-API-Vulnerability+ CVEBroken LinkThird Party Advisory
http://archive.today/rdkeQ [email protected]Third Party Advisory

see all 7 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability NameDate AddedDue DateRequired Action
Kaseya VSA SQL Injection VulnerabilityMay 24, 2022Jun 14, 2022The impacted product is end-of-life and should be disconnected if still in use.

Weakness Enumeration

CWE-IDCWE NameSource
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')[email protected]
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CISA-ADP

Affected Products

ProductVersions
connectwise manageditsync
<= 2017

CPE

  • cpe:2.3:a:connectwise:manageditsync:*:*:*:*:*:kaseya_vsa:*:*

Remediation

  • No remediation found in references.

Change History

13 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2017-18362
NVD Published Date:
Feb 5, 2019
NVD Last Modified:
Aug 13, 2026
Source:
[email protected]
CVE-2017-18362 Details - Not Deferred