PT-2019-13112 · Quest · Quest Kace Systems Management Appliance Server Center

Publicado 2019-11-06 · Atualizado 2019-11-07 · CVE-2019-13077

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317

Description The issue allows an attacker to create a malicious link to attack authenticated users due to an XSS vulnerability. This vulnerability is exploited via the SAM TYPE parameter in the "sam detail titled.php" page.

Recommendations For version 9.1.317, avoid using the SAM TYPE parameter in the "sam detail titled.php" page until the issue is resolved. As a temporary workaround, consider restricting access to the "sam detail titled.php" page to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-13077

Produtos afetados

Quest Kace Systems Management Appliance Server Center

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-13077 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13077 · Nota de Segurança
• https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report · Aviso do Fabricante
• https://quest.com/products/kace-systems-management-appliance · Nota