PT-2019-13020 · Quest · Quest Kace Systems Management Appliance Server Center

Published 2019-11-06 · Updated 2019-11-07 · CVE-2019-12918

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317

Description The issue concerns a SQL injection problem. The affected file is software library.php, and the vulnerable parameters are order[0][column] and order[0][dir].

Recommendations For Quest KACE Systems Management Appliance Server Center version 9.1.317, consider restricting access to the software library.php file and avoid using the parameters order[0][column] and order[0][dir] until a fix is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-12918

Affected Products

Quest Kace Systems Management Appliance Server Center

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-12918 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12918 · Vendor Advisory
• https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report · Vendor Advisory
• https://quest.com/products/kace-systems-management-appliance · Note