critical9.8
CVE-2021-44029
An issue was discovered in Quest KACE Desktop Authority before 11.2.
Impact
An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Quest | Kace Desktop Authority | from 10.0 before 11.2 |