CVE-2021-32088
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In Quest KACE SMA 11.0.273, the rate-limiting feature for API endpoints can be bypassed by removing the kboxid cookie, enabling brute-force attacks.
Risk Assessment
An attacker can perform a successful brute-force attack on the API, potentially leading to account takeover or access to sensitive data.
Recommendation
Update to a version where the rate-limiting mechanism is fixed and implement additional protections such as CAPTCHA.
Other vulnerabilities in Quest KACE Systems Deployment Appliance
See all- CVE-2021-32086Critical
Quest KACE SMA 11.0.273 uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL database. The key is not unique per installation, so an attacker with access to the MySQL server or backups can decrypt the secrets.
- CVE-2021-32084Critical
In Quest KACE SMA 11.0.273, access restrictions to the web console (e.g., by IP address) do not apply to API endpoints. If an attacker knows credentials or API keys, they can access the appliance via the API, potentially compromising the entire environment.
- CVE-2021-32087High
Quest KACE SMA 11.0.273 ships with default credentials for the kbftp account (password getbxf), which is publicly known. A remote attacker can gain privileged access to the FTP service containing MySQL backups with sensitive data.
- CVE-2021-32085High
Quest KACE SMA 11.0.273 ships with default credentials for the MySQL accounts report and R1 (password box747), which is publicly known. A remote attacker can gain privileged access to MySQL databases containing sensitive data.
Original NVD description (English source)
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.