PT-2019-10964 · Quest · Quest Kace K1000 Appliance

Published 2019-06-03 · Updated 2019-10-09 · CVE-2018-5405

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Quest Kace K1000 Appliance versions prior to 9.0.270

Description: The issue allows an authenticated user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. This could enable a malicious user to steal session cookies of other users, including Administrators, and take over their sessions. The software fails to properly neutralize user-controllable input before it is placed in output that is used as a web page served to other users, allowing for the injection of arbitrary JavaScript code. This can be exploited to launch other attacks.

Recommendations: For versions prior to 9.0.270, update to version 9.0.270 or later to resolve the issue. As a temporary workaround, consider restricting access to the tickets page for users with 'User Console Only' rights until the update is applied. Additionally, monitor user activity closely to detect and respond to potential session takeover attempts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-5405

Affected Products

Quest Kace K1000 Appliance

References · 6

• 🔥 http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/46956 · Exploit
• https://support.quest.com/kb/288310/cert-coordination-center-report-update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5405 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5405 · Vendor Advisory
• https://kb.cert.org/vuls/id/877837 · Note