CVE-2018-11142

The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from…

published May 31, 2018

CVSS
—
EPSS
0%
Percentile
34.9
In the wild
Unconfirmed
What it is

The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'X_Forwarded_For' HTTP headers in a POST request. An anonymous user can abuse this vulnerability to execute critical functions without authorization.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00417 · 34.9th percentile
Published
2018-05-31T18:00Z
EPSS history
Timeline
  • 31 MAY 18:00Z
    The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from…
    cvelistv5