PT-2021-24020 · Quest · Kace Desktop Authority

Publicado 2021-12-22 · Atualizado 2022-01-03 · CVE-2021-44029

Telegram · Cvenotify

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

🚨 CVE-2021-44029 An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation.

🎖@cveNotify

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2021-44029

Produtos afetados

Kace Desktop Authority

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-44029 · Nota de Segurança
• https://t.me/cvenotify/24771 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2021-44029 · Aviso do Fabricante
• https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2 · Aviso do Fabricante