Vulnerability Description
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. A malicious internal user could also gain administrator privileges of this appliance and use it to visit a malicious link that exploits this vulnerability. This could cause the application to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. An unauthenticated, remote attacker could add an administrator-level account or change the appliance's settings.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Quest | Kace Systems Management Appliance Firmware | < 9.0.270 |
| Quest | Kace Systems Management Appliance | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-AppliancExploitThird Party AdvisoryVDB Entry
- https://support.quest.com/kb/288310/cert-coordination-center-report-updateVendor Advisory
- https://www.kb.cert.org/vuls/id/877837/Third Party AdvisoryUS Government Resource
- http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-AppliancExploitThird Party AdvisoryVDB Entry
- https://support.quest.com/kb/288310/cert-coordination-center-report-updateVendor Advisory
- https://www.kb.cert.org/vuls/id/877837/Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2018-5406?
CVE-2018-5406 is a vulnerability with a CVSS score of 8.8 (HIGH). The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker cou...
How severe is CVE-2018-5406?
CVE-2018-5406 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-5406?
Check the references section above for vendor advisories and patch information. Affected products include: Quest Kace Systems Management Appliance Firmware, Quest Kace Systems Management Appliance.