PT-2019-10964 · Quest · Quest Kace K1000 Appliance

Publicado 2019-06-03 · Atualizado 2019-10-09 · CVE-2018-5405

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Quest Kace K1000 Appliance versions prior to 9.0.270

Description: The issue allows an authenticated user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. This could enable a malicious user to steal session cookies of other users, including Administrators, and take over their sessions. The software fails to properly neutralize user-controllable input before it is placed in output that is used as a web page served to other users, allowing for the injection of arbitrary JavaScript code. This can be exploited to launch other attacks.

Recommendations: For versions prior to 9.0.270, update to version 9.0.270 or later to resolve the issue. As a temporary workaround, consider restricting access to the tickets page for users with 'User Console Only' rights until the update is applied. Additionally, monitor user activity closely to detect and respond to potential session takeover attempts.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-5405

Produtos afetados

Quest Kace K1000 Appliance

Referências · 6

• 🔥 http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/46956 · Exploit
• https://support.quest.com/kb/288310/cert-coordination-center-report-update · Aviso do Fabricante
• https://kb.cert.org/vuls/id/877837 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-5405 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-5405 · Aviso do Fabricante