PT-2018-10329 · Quest · Quest Kace System Management Appliance

Guido Leo + 1 · Publicado 2018-05-31 · Atualizado 2025-11-05 · CVE-2018-11138

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quest KACE System Management Appliance version 8.0.318

Description The issue concerns the accessibility of the "/common/download agent installer.php" script by anonymous users, which can be exploited to execute arbitrary commands on the system.

Recommendations For Quest KACE System Management Appliance version 8.0.318, restrict access to the "/common/download agent installer.php" script to prevent anonymous users from executing arbitrary commands.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-11138

Produtos afetados

Quest Kace System Management Appliance

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/quest_kace_systems_management_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44950 · Exploit
• 🔥 https://coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2018-11138 · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11138 · Nota
• https://t.me/cvenotify/108379 · Publicação no Telegram
• https://t.me/cveNotify/141848 · Publicação no Telegram
• https://t.me/cvenotify/114858 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-11138 · Nota de Segurança