CVE-2019-10973 Missing authorization in Quest KACE
Attackers can bypass authentication to access troubleshooting tools in the Quest KACE administrator interface, potentially exposing sensitive system information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-10973?
CVE-2019-10973 is a high-severity missing authorization vulnerability in Quest KACE, published on 8 Jul 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface.
Weakness: CWE-20
Which versions are affected by CVE-2019-10973?
It affects 1 product.
Products include Quest Kace Systems Management Appliance.
How do I fix CVE-2019-10973?
No fix has been published for CVE-2019-10973 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-10973 being exploited?
There is no known exploitation of CVE-2019-10973 in the wild and no public exploit code.
Other vulnerabilities in Quest KACE
- CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication
- CVE-2021-32084 Missing authorization in n/a
- CVE-2021-32086 Hardcoded credentials in n/a
- CVE-2021-32088 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.
- CVE-2022-29807 SQL injection in n/a
Sources
Also known as GHSA-qq7m-c52g-r8p8.