The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections.
CVE-2018-5404

6.5MEDIUM

Key Information:

Vendor

Quest Kace

Status
K1000 Appliance
Vendor
CVE Published:
3 June 2019

What is CVE-2018-5404?

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.

Affected Version(s)

K1000 Appliance 9.0.270

References

https://www.kb.cert.org/vuls/id/877837/
third-party-advisoryx_refsource_CERT-VN
https://support.quest.com/kb/288310/cert-coordination-cen...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks to Kapil Khot for reporting this vulnerability.
.