CVE-2018-11141 | BDVDB-2026-101389 Detail

Description#

The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities

Exploit#

No public exploit known

History#

Version 12018-05-31Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.