PT-2019-12411 · Quest · Quest Kace System Management Appliance

Julien Ahrens · Published 2019-05-24 · Updated 2019-10-07 · CVE-2019-11604

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance versions prior to 9.1

Description The issue concerns an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. It occurs when user-supplied input to the METHOD parameter in the /service/kbot service notsoap.php script is processed by the web application without proper validation and sanitization, allowing arbitrary script code to be placed into the context of the same page.

Recommendations For Quest KACE Systems Management Appliance versions prior to 9.1, update to version 9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /service/kbot service notsoap.php script to minimize the risk of exploitation. Avoid using the METHOD parameter in the affected script until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-11604

Affected Products

Quest Kace System Management Appliance

References · 7

• 🔥 http://seclists.org/fulldisclosure/2019/May/40 · Exploit
• 🔥 http://packetstormsecurity.com/files/153053/Quest-KACE-Systems-Management-Appliance-9.0-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-11604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11604 · Security Note
• https://t.me/defcon_news/14677 · Telegram Post
• https://t.me/cybersecuritytechnologies/418 · Telegram Post
• https://rcesecurity.com · Note