CVE-2018-11137 | BDVDB-2026-101385 Detail
Description#
The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.