CVE-2018-11139

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be…

published May 31, 2018

CVSS
—
EPSS
42%
Percentile
98.7
In the wild
Unconfirmed
What it is

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.42409 · 98.7th percentile
Published
2018-05-31T18:00Z
EPSS history
Timeline
  • 22 SEP 03:15Z
    EPSS moved 43% → 77%
    epss
  • 06 SEP 03:11Z
    EPSS moved 43% → 77%
    epss
  • 30 AUG 16:00Z
    EPSS moved 77% → 43%
    epss
  • 29 AUG 04:31Z
    EPSS moved 43% → 77%
    epss
  • 31 MAY 18:00Z
    The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be…
    cvelistv5