Skip to content
Fencer Vulns
medium 5.4

CVE-2018-5405 json

The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.

published 2019-06-03 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-17175

cvss
5.4
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.6%
EPSS 3.6% chance of exploitation in 30 days, percentile 89%
public exploits
1
Exploit-DB

Summary

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of other users including Administrator and take over their session. This can further be exploited to launch other attacks. The software also does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other user. An authenticated user with 'user console only' rights may inject arbitrary JavaScript, which could result in an attacker taking over a session of others, including an Administrator.

Patch / fix

  • quest kace_systems_management_appliance_firmware 9.0.270

Timeline

  1. First public exploit (EDB-46956)
  2. Published

Exploit prediction

3.61% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-46956 KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities webapps, 2019-06-03
  • packetstormsecurity.com http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

  • Quest Kace K1000 Appliance

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.