Lucene search
PRIOn knowledge basePRION:CVE-2018-11142HistoryMay 31, 2018 - 6:29 p.m.
Authorization
2018-05-3118:29:00
PRIOn knowledge base
www.prio-n.com
3
The ‘systemui/settings_network.php’ and ‘systemui/settings_patching.php’ scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the ‘Host’ and ‘X_Forwarded_For’ HTTP headers in a POST request. An anonymous user can abuse this vulnerability to execute critical functions without authorization.
| CPE | Name | Operator | Version |
|---|---|---|---|
| kace_system_management_appliance | eq | 8.0.318 |
Related
cve
cve
CVE-2018-11142
2018-05-31 18:29:00
cvelist
cvelist
CVE-2018-11142
2018-05-31 18:00:00
nvd
nvd
CVE-2018-11142
2018-05-31 18:29:00
coresecurity
coresecurity
Quest KACE System Management Appliance Multiple Vulnerabilities
2018-05-31 00:00:00
zdt
zdt
Quest KACE System Management Appliance 8.0 - Multiple Vulnerabilities
2018-06-01 00:00:00
packetstorm
packetstorm