Command Injection Vulnerability in Quest KACE System Management Appliance 8.0.318

CVE-2018-11132 · HIGH Severity

AV:N/AC:L/AU:S/C:C/I:C/A:C

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.

Learn more about our User Device Pen Test.