Medium severity · published Jun 3, 2019
CVE-2018-5404
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit…
6.5
CVSS
3.8%
EPSS
No
On KEV
Description
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KS
Kace Systems Management Appliance Firmware · Quest
before 9.0.270 · source: NVD
Affected product
KS
Kace Systems Management Appliance Firmware
Quest
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-5404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-5404
Vendor Advisory
https://support.quest.com/kb/288310/cert-coordination-center-report-update
Third Party Advisory
https://www.kb.cert.org/vuls/id/877837/
More from Kace Systems Management Appliance Firmware
8.8
CVE-2018-5406
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism
5.4
CVE-2018-5405
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript…