CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Permissions Privileges and Access Controls
Summary: the quest kace k1000 appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured cross-origin resource sharing (cors) mechanism. an unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator account or changing the appliance?s settings. a malicious internal user could also gain administrator privileges of this appliance and use it to visit a malicious link that exploits this vulnerability. this could cause the application to perform sensitive actions such as adding a new administrator account or changing the appliance?s settings. an unauthenticated, remote attacker could add an administrator-level account or change the appliance's settings.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-06-03
Last Modified Date: 2019-10-10