Privilege Escalation Vulnerability in Quest KACE System Management Appliance
CVE-2018-11134

8.8HIGH

Key Information:

Vendor

Quest

Status
Kace System Management Appliance
Vendor
CVE Published:
31 May 2018

What is CVE-2018-11134?

The Quest KACE System Management Appliance 8.0.318 has a security flaw that allows low-privilege users to escalate their privileges. This vulnerability stems from a message queue feature that operates with root privileges and permits certain commands, including the ability to alter user passwords. By exploiting this feature, an attacker can change the password for the 'kace_support' account, which, despite being disabled by default, possesses full sudo privileges. This issue highlights the critical need for strict access controls and proper oversight of command permissions within system management tools.

References

https://www.coresecurity.com/advisories/quest-kace-system...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.