CVEvulnerability
CVE-2019-13078
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-11-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /common/user_profile.php. The affected parameter is sort_column.
Affected configurations
• quest kace systems management appliance 9.1.317
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report Vendor Advisory
- https://www.quest.com/products/kace-systems-management-appliance/ Product
- https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report Vendor Advisory
- https://www.quest.com/products/kace-systems-management-appliance/ Product