PT-2019-13112 · Quest · Quest Kace Systems Management Appliance Server Center

Published 2019-11-06 · Updated 2019-11-07 · CVE-2019-13077

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317

Description The issue allows an attacker to create a malicious link to attack authenticated users due to an XSS vulnerability. This vulnerability is exploited via the SAM TYPE parameter in the "sam detail titled.php" page.

Recommendations For version 9.1.317, avoid using the SAM TYPE parameter in the "sam detail titled.php" page until the issue is resolved. As a temporary workaround, consider restricting access to the "sam detail titled.php" page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-13077

Affected Products

Quest Kace Systems Management Appliance Server Center

References · 4

• https://osv.dev/vulnerability/CVE-2019-13077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13077 · Security Note
• https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report · Vendor Advisory
• https://quest.com/products/kace-systems-management-appliance · Note