CVE-2018-5404
moderate-risk
Published 2019-06-03
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.
Do I need to act?
-
0.46% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10
Medium
NETWORK
/ LOW complexity
Affected Products (1)
Affected Vendors
References (4)
Third Party Advisory
https://www.kb.cert.org/vuls/id/877837/
Third Party Advisory
https://www.kb.cert.org/vuls/id/877837/
38
/ 100
moderate-risk
Severity
24/34 · High
Exploitability
9/34 · Low
Exposure
5/34 · Minimal