Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-5404: Quest Kace K1000 Appliance can leak database data

CVE-2018-5404 · published 7 years ago

Summary

The Quest Kace K1000 system firmware before version 9.0.270 lets a user with only the basic console role run hidden database queries. This could let an attacker read or copy confidential information stored in the appliance’s database. Upgrade to the latest firmware or restrict console access to trusted personnel.

What to do

Update quest kace_systems_management_appliance_firmware to version 9.0.270 or later.

Affected software

Vendor	Product	Affected versions
quest	kace_systems_management_appliance_firmware	< 9.0.270 `cpe:2.3:o:quest:kace_systems_management_appliance_firmware::::::::`

Original advisory text

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.

References

https://support.quest.com/kb/288310/cert-coordination-center-report-update Vendor Advisory
https://www.kb.cert.org/vuls/id/877837/ Third Party Advisory US Government Resource

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

4% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published3 Jun 2019

Updated23 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-5404 · NVD

Track software like this

Free during beta