CVE-2019-20504

Name of the Vulnerable Software and Affected Versions Quest KACE K1000 Systems Management Appliance versions prior to 6.4 SP3 (6.4.120822)

Description The issue allows a remote attacker to execute code via shell metacharacters in the kuid parameter in the service/krashrpt.php file.

Recommendations For versions prior to 6.4 SP3 (6.4.120822), update to version 6.4 SP3 (6.4.120822) or later to resolve the issue. As a temporary workaround, consider restricting access to the service/krashrpt.php file to minimize the risk of exploitation. Avoid using the kuid parameter in the affected API endpoint until the issue is resolved.