PT-2021-24020 · Quest · Kace Desktop Authority

Published 2021-12-22 · Updated 2022-01-03 · CVE-2021-44029

Telegram · Cvenotify

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

🚨 CVE-2021-44029 An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation.

🎖@cveNotify

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-44029

Affected Products

Kace Desktop Authority

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-44029 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44029 · Vendor Advisory
• https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2 · Vendor Advisory
• https://t.me/cvenotify/24771 · Telegram Post