VULNERABILITY INTELLIGENCE

CVE-2018-11139

CVSS score8.8 HIGH

EPSS probability42.41%

CISA KEVNot currently listed

Published2018-05-31

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.

Weakness classification

nvd@nist.gov: CWE-78

Primary references

cve@mitre.org — Exploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Technical Description, Third Party Advisory