CVE-2018-11139
Summary
| CVE | CVE-2018-11139 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-05-31 18:29:00 UTC |
| Updated | 2019-10-03 00:03:00 UTC |
| Description | The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method. |
Risk And Classification
Problem Types: CWE-78
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Quest | Kace System Management Appliance | 8.0.318 | All | All | All |
| Application | Quest | Kace System Management Appliance | 8.0.318 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Quest KACE System Management Appliance Multiple Vulnerabilities | SecureAuth | MISC | www.coresecurity.com | Exploit, Technical Description, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.