Command Injection Vulnerability in Quest KACE System Management Appliance
CVE-2018-11139

8.8HIGH

Key Information:

Vendor

Quest

Status
Kace System Management Appliance
Vendor
CVE Published:
31 May 2018

What is CVE-2018-11139?

The KACE System Management Appliance features a script located at '/common/ajax_email_connection_test.php' that is accessible to any authenticated user. This script is susceptible to command injection vulnerabilities due to the unsanitized user input from the 'TEST_SERVER' parameter sent via POST requests. An attacker can exploit this flaw to execute arbitrary commands on the system, potentially compromising its integrity and confidentiality.

References

https://www.coresecurity.com/advisories/quest-kace-system...
x_refsource_MISC

EPSS Score

26% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2018-11139 : Command Injection Vulnerability in Quest KACE System Management Appliance