CVE Catalog
CVE-2021-32088
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.15%
5th percentile - higher than 5% of all known CVEs
Summary
In Quest KACE SMA 11.0.273, the rate-limiting feature for API endpoints can be bypassed by removing the kboxid cookie, enabling brute-force attacks.
Risk Assessment
An attacker can perform a successful brute-force attack on the API, potentially leading to account takeover or access to sensitive data.
Recommendation
Update to a version where the rate-limiting mechanism is fixed and implement additional protections such as CAPTCHA.
Original NVD description (English source)
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.