CVE-2018-11138

CRITICALCISA KEV

9.8

Beschreibung

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht5/31/2018

Zuletzt geandert11/5/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerQuest

ProduktKACE System Management Appliance

SchwachstellennameQuest KACE System Management Appliance Remote Command Execution Vulnerability

KEV Aufnahmedatum2022-03-25

Behebungsfrist2022-04-15

Ransomware-NutzungKnown

Betroffene Produkte

quest:kace_system_management_appliance

Schwachen (CWE)

CWE-78CWE-78

Referenzen

https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities(cve@mitre.org)

https://www.exploit-db.com/exploits/44950/(cve@mitre.org)

https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/44950/(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11138(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.