Medium severity · published May 24, 2019
CVE-2019-11604
An issue was discovered in Quest KACE Systems Management Appliance before 9.1
6.1
CVSS
1.8%
EPSS
No
On KEV
Description
An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary script code into the context of the same page.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KS
Kace Systems Management Appliance · Quest
before 9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11604
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11604
Exploit
http://packetstormsecurity.com/files/153053/Quest-KACE-Systems-Management-Appliance-9.0-Cross-Site-Scripting.html
Exploit
http://seclists.org/fulldisclosure/2019/May/40
Third Party Advisory
https://www.rcesecurity.com/
More from Kace Systems Management Appliance
10.0
CVE-2025-32975
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
9.8
CVE-2021-32088
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
9.8
CVE-2021-32084
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
9.8
CVE-2021-32086
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
9.8
CVE-2022-29807
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php