Read the docs
TI-2018-03932 Aliases CVE-2018-5404GHSA-rgpj-f9xq-fr9h

The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections.

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.

Why it matters now

EPSS 0.03765 89th percentileScored 2026-11-07
Fix Fixed K1000 Appliance (Quest Kace): 9.0.270

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QuestK1000 Appliance9.0.270 to before 9.0.2709.0.270Patch availableCNA
  • K1000 Appliance VendorQuest Affected 9.0.270 to before 9.0.270 Fixed in 9.0.270 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:quest:kace_systems_management_appliance_firmware:*:*:*:*:*:*:*:*before 9.0.270VulnerableQuest
cpe:2.3:h:quest:kace_systems_management_appliance:-:*:*:*:*:*:*:*not specified by NVDRunning onQuest
  • cpe:2.3:o:quest:kace_systems_management_appliance_firmware:*:*:*:*:*:*:*:* Versions before 9.0.270 Vulnerable ·Quest
  • cpe:2.3:h:quest:kace_systems_management_appliance:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Quest

Remediation

  • Fix · CNA K1000 Appliance (Quest Kace) Fixed in 9.0.270

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Quest Kace K1000 Appliance 9.0.270

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-03934 The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism.Priority MEDIUM 52
    • TI-2018-03933 The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.Priority LOW 31
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5404
  2. 2026-10-03 Alias added: GHSA-rgpj-f9xq-fr9h

References

Advisory 2

  • TI-2018-03934 The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism. CVSS 3.1HIGH 8.8
  • TI-2018-03933 The Quest Kace K1000 Appliance is vulnerable to JavaScript injection. CVSS 3.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences