CoreCVE
Back

HIGH

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system

Published May 31, 2018

Description

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published May 31, 2018
Updated Aug 5, 2024
Reserved May 15, 2018
Link CVE-2018-11139
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-11139
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-11139
ENISA EUVD
Assigner mitre
Published May 31, 2018
Updated Aug 5, 2024
Exploited since n/a
Link EUVD-2018-3181
EUVD-2018-3181