Unauthorized Access Vulnerability in Quest KACE System Management Appliance
CVE-2018-11142

5.5MEDIUM

Key Information:

Vendor

Quest

Status
Kace System Management Appliance
Vendor
CVE Published:
31 May 2018

What is CVE-2018-11142?

The Quest KACE System Management Appliance has a vulnerability that permits unauthorized access to sensitive functionalities by manipulating HTTP headers. Specifically, the 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts, which should only be accessible from localhost, can be reached by altering the 'Host' and 'X_Forwarded_For' headers in a POST request. This flaw allows an anonymous user to execute critical administrative functions, posing a significant risk to system integrity and data security.

References

https://www.coresecurity.com/advisories/quest-kace-system...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2018-11142 : Unauthorized Access Vulnerability in Quest KACE System Management Appliance