CVE-2018-11137

The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary…

published May 31, 2018

CVSS
—
EPSS
6%
Percentile
93.6
In the wild
Unconfirmed
What it is

The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06384 · 93.6th percentile
Published
2018-05-31T18:00Z
EPSS history
Timeline
  • 31 MAY 18:00Z
    The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary…
    cvelistv5