How severe is CVE-2021-30120?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.5 out of 10.

What type of vulnerability is CVE-2021-30120?

This is classified as CWE-669, which is a common weakness in software security.

CVE-2021-30120 - HIGH Severity | CVSS 7.5

Vulnerability Description

Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.

Related Vulnerabilities

CVE-2012-2979

HIGH

CVSS:7.5(High)

FreeBSD NSD before 3.2.13 allows remote attackers to crash a NSD child server process (SIGSEGV) and cause a denial of service in the NSD server.

CWE-6692012

CVE-2018-17791

HIGH

CVSS:7.5(High)

Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered, and inappropriate information is stored...

CWE-6692018

CVE-2021-20411

HIGH

CVSS:7.5(High)

IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to impersonate another user on the system due to incorrectly updating the session identifier. IBM X-Force ID: 198191.

CWE-6692021

CVE-2021-22806

HIGH

CVSS:7.5(High)

A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when accessing a malicious website. Affected Product: spaceLYnk (...

CWE-6692021

CVE-2023-31115

HIGH

CVSS:7.5(High)

An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause changes to the activation mode of RCS via a crafted ap...

CWE-6692023

CVE-2023-44100

HIGH

CVSS:7.5(High)

Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.

CWE-6692023