CVE-2019-15506: 
Kaseya VSA Server vulnerability analysis and mitigation

An issue was discovered in Kaseya Virtual System Administrator (VSA) through version 9.4.0.37, identified as CVE-2019-15506. This critical information disclosure vulnerability allows unauthenticated attackers to access and download sensitive files and information from the web application through properly formatted requests (MITRE CVE, DFDR Blog).

The vulnerability exists in the web application's file access controls, specifically affecting directories such as /DATAREPORTS. An unauthenticated attacker can send specially crafted requests to access and download sensitive system information and reports. The vulnerability was discovered by Ken Pyle from DFDR Consulting (DFDR Blog).

The vulnerability allows attackers to access critical system information including NMAP reports, Patch Status data, and Active Directory domain metadata. This information disclosure could provide attackers with valuable intelligence about the target system's infrastructure and security posture (DFDR Blog).

The vulnerability can be exploited by unauthenticated attackers who can craft specific requests to access sensitive directories and files. No authentication is required to exploit this vulnerability, making it particularly dangerous (DFDR Blog).

Kaseya has acknowledged the vulnerability and released a patch. Users are strongly advised to update to the latest version of the software that contains fixes for this vulnerability (DFDR Blog).