PT-2019-12411 · Quest · Quest Kace System Management Appliance

Julien Ahrens · Publicado 2019-05-24 · Atualizado 2019-10-07 · CVE-2019-11604

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance versions prior to 9.1

Description The issue concerns an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. It occurs when user-supplied input to the METHOD parameter in the /service/kbot service notsoap.php script is processed by the web application without proper validation and sanitization, allowing arbitrary script code to be placed into the context of the same page.

Recommendations For Quest KACE Systems Management Appliance versions prior to 9.1, update to version 9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /service/kbot service notsoap.php script to minimize the risk of exploitation. Avoid using the METHOD parameter in the affected script until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-11604

Produtos afetados

Quest Kace System Management Appliance

Referências · 7

• 🔥 http://seclists.org/fulldisclosure/2019/May/40 · Exploit
• 🔥 http://packetstormsecurity.com/files/153053/Quest-KACE-Systems-Management-Appliance-9.0-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-11604 · Aviso do Fabricante
• https://t.me/defcon_news/14677 · Publicação no Telegram
• https://t.me/cybersecuritytechnologies/418 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-11604 · Nota de Segurança
• https://rcesecurity.com · Nota