What is CVE-2018-11141?

CVE-2018-11141 is a critical-severity vulnerability in Quest Kace System Management Appliance, classified under Path Traversal. CVSS score: 9.8/10. Published 2018-05-31.

How severe is CVE-2018-11141?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Path Traversal in Quest Kace System Management Appliance

CVE-2018-11141

The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.073 (94.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Quest Kace_system_management_appliance — versions 8.0.318
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-11141?: CVE-2018-11141 is a critical-severity vulnerability in Quest Kace System Management Appliance, classified under Path Traversal. CVSS score: 9.8/10. Published 2018-05-31.
How severe is CVE-2018-11141?: Critical severity. CVSS v3 base score is 9.8 out of 10.