CVE-2021-32084

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Deployment Appliance (SMA) version 11.0.273

Description An issue exists where API endpoints are not subject to the same IP address or subnet restrictions applied to the web console. If an attacker possesses valid credentials or API keys, they can bypass these network restrictions to access the appliance via the API, potentially compromising the entire configured KACE environment.

Recommendations Update Quest KACE Systems Deployment Appliance (SMA) version 11.0.273 to a version that enforces IP restrictions on API endpoints.