CVE-2018-5406: The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism.
First published: Mon Jun 03 2019(Updated: )
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. A malicious internal user could also gain administrator privileges of this appliance and use it to visit a malicious link that exploits this vulnerability. This could cause the application to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. An unauthenticated, remote attacker could add an administrator-level account or change the appliance's settings.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Quest Kace Systems Management Appliance Firmware | <9.0.270 | |
| Quest KACE Systems Management Appliance |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the Quest Kace K1000 Appliance?
The vulnerability ID for the Quest Kace K1000 Appliance is CVE-2018-5406.
What is the severity level of CVE-2018-5406?
The severity level of CVE-2018-5406 is critical with a severity value of 8.8.
How can an attacker exploit CVE-2018-5406?
An attacker can exploit CVE-2018-5406 by exploiting the misconfigured Cross-Origin Resource Sharing (CORS) mechanism.
What are the affected versions of the Quest Kace K1000 Appliance?
Versions prior to 9.0.270 of the Quest Kace K1000 Appliance are affected.
Are there any known fixes for CVE-2018-5406?
Yes, the fix for CVE-2018-5406 is to update to version 9.0.270 or later of the Quest Kace K1000 Appliance.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/title
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- vendor/quest
- canonical/quest kace systems management appliance firmware
- canonical/quest kace systems management appliance