CVE-2019-11604 - An issue was discovered in Quest KACE Systems Management Appliance before 9.1

Back Back to CVE browser

MEDIUM

An issue was discovered in Quest KACE Systems Management Appliance before 9.1

Published May 24, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 1.78%

Description

An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary script code into the context of the same page.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

http://packetstormsecurity.com/files/153053/Quest-KACE-Systems-Management-Appliance-9.0-Cross-Site-Scripting.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/May/40
mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory
https://www.rcesecurity.com/
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/153053/Quest-KACE-Systems-Management-Appliance-9.0-Cross-Site-Scripting.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/May/40		mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory
https://www.rcesecurity.com/		x_refsource_MISCThird Party Advisory