PT-2019-13020 · Quest · Quest Kace Systems Management Appliance Server Center

Publicado 2019-11-06 · Atualizado 2019-11-07 · CVE-2019-12918

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317

Description The issue concerns a SQL injection problem. The affected file is software library.php, and the vulnerable parameters are order[0][column] and order[0][dir].

Recommendations For Quest KACE Systems Management Appliance Server Center version 9.1.317, consider restricting access to the software library.php file and avoid using the parameters order[0][column] and order[0][dir] until a fix is available.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-12918

Produtos afetados

Quest Kace Systems Management Appliance Server Center

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-12918 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12918 · Aviso do Fabricante
• https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report · Aviso do Fabricante
• https://quest.com/products/kace-systems-management-appliance · Nota