What is CVE-2019-13078?

CVE-2019-13078 is a high-severity vulnerability in Quest Kace Systems Management Appliance, classified under SQL Injection. CVSS score: 8.8/10. Published 2019-11-06.

How severe is CVE-2019-13078?

High severity. CVSS v3 base score is 8.8 out of 10.

SQL Injection in Quest Kace Systems Management Appliance

CVE-2019-13078

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /common/user_profile.php. The affected parameter is sort_column.

Vulnerability class: SQL Injection

EPSS: 0.012 (66.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Quest Kace_systems_management_appliance — versions 9.1.317
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Product, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-13078?: CVE-2019-13078 is a high-severity vulnerability in Quest Kace Systems Management Appliance, classified under SQL Injection. CVSS score: 8.8/10. Published 2019-11-06.
How severe is CVE-2019-13078?: High severity. CVSS v3 base score is 8.8 out of 10.