CVE-2018-11142

PoC —

CVSS 3.0

5.5 medium

EPSS

<1%p36

Published

May 31, 2018 (May 31, 2018)

Modified

Jun 17, 2026

Description

The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'X_Forwarded_For' HTTP headers in a POST request. An anonymous user can abuse this vulnerability to execute critical functions without authorization.

Vendors: quest
Products: kace system management appliance
Weakness: CWE-863
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.