Critical severity · published May 31, 2018
CVE-2018-11141
The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to…
9.8
CVSS
2%
EPSS
No
On KEV
Description
The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KS
Kace System Management Appliance · Quest
8.0.318 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11141
Exploit
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
More from Kace System Management Appliance
9.8
CVE-2018-11138
Quest KACE System Management Appliance Remote Command Execution Vulnerability
9.8
CVE-2018-11140
The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in…
9.8
CVE-2018-11136
The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL…
8.8
CVE-2018-11139
The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute…
8.8
CVE-2018-11135
The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks