AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2018-11142

MEDIUM · CVSS 5.5 EPSS 0.42%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-05-31 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2018-11142
Severity
MEDIUM
CVSS
5.5
EPSS
0.42%

Original NVD Description

The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'X_Forwarded_For' HTTP headers in a POST request. An anonymous user can abuse this vulnerability to execute critical functions without authorization.