Medium severity · published Mar 1, 2023
CVE-2022-38220
An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary web script or HTML
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary web script or HTML.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KS
Kace Systems Management Appliance · Quest
through 12.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38220
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38220
Broken Link
https://support.quest.com/kb/339613
Vendor Advisory
https://support.quest.com/kb/4368602/quest-response-to-kace-sma-vulnerability-cve-2022-38220
More from Kace Systems Management Appliance
10.0
CVE-2025-32975
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
9.8
CVE-2021-32088
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
9.8
CVE-2021-32084
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
9.8
CVE-2021-32086
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
9.8
CVE-2022-29807
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php