CVE-2018-11132

HIGH

Quest KACE System Management Appliance 8.0.318 - Authenticated OS Command Injection via Message Queue

Title source: llm
STIX 2.1

Description

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.

References (1)

Core 1
Core References
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities

Scores

CVSS v3 8.8
EPSS 0.1829
EPSS Percentile 96.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
quest/kace_system_management_appliance 8.0.318
Published May 31, 2018
Tracked Since Feb 18, 2026