What is CVE-2019-13076?

CVE-2019-13076 is a high-severity vulnerability in Quest Kace Systems Management Appliance, classified under SQL Injection. CVSS score: 8.8/10. Published 2019-11-06.

How severe is CVE-2019-13076?

High severity. CVSS v3 base score is 8.8 out of 10.

SQL Injection in Quest Kace Systems Management Appliance

CVE-2019-13076

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticket_list.php, and affected parameters are order[0][column] and order[0][dir].

Vulnerability class: SQL Injection

EPSS: 0.012 (66.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Quest Kace_systems_management_appliance — versions 9.1.317
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Product, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-13076?: CVE-2019-13076 is a high-severity vulnerability in Quest Kace Systems Management Appliance, classified under SQL Injection. CVSS score: 8.8/10. Published 2019-11-06.
How severe is CVE-2019-13076?: High severity. CVSS v3 base score is 8.8 out of 10.