CVE

Id
28646  
CVE No.
CVE-2007-5289  
Status
Candidate  
Description
HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%TD_80, and then setting the file"s properties to read-only.  
Phase
Assigned (20071009)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
298492 28646 CVE-2007-5289 BUGTRAQ:20090223 HP Quality Center vulnerability  View
298493 28646 CVE-2007-5289 URL:http://www.securityfocus.com/archive/1/archive/1/501177/100/0/threaded  View
298494 28646 CVE-2007-5289 BUGTRAQ:20090224 Re: HP Quality Center vulnerability  View
298495 28646 CVE-2007-5289 URL:http://www.securityfocus.com/archive/1/archive/1/501219/100/0/threaded  View
298496 28646 CVE-2007-5289 MISC:http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/  View
298497 28646 CVE-2007-5289 CERT-VN:VU#898865  View
298498 28646 CVE-2007-5289 URL:http://www.kb.cert.org/vuls/id/898865  View
298499 28646 CVE-2007-5289 BID:33854  View
298500 28646 CVE-2007-5289 URL:http://www.securityfocus.com/bid/33854  View
298501 28646 CVE-2007-5289 SECUNIA:34015  View
298502 28646 CVE-2007-5289 URL:http://secunia.com/advisories/34015  View
298503 28646 CVE-2007-5289 SECUNIA:34046  View
298504 28646 CVE-2007-5289 URL:http://secunia.com/advisories/34046  View
298505 28646 CVE-2007-5289 XF:hpqualitycenter-workflowscripts-sec-bypass(48860)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
54059 JVNDB-2007-002751 DB Manager の Edit.asp におけるクロスサイトスクリプティングの脆弱性 DB Manager の Edit.asp には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2007-5291 28646 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-002751.html  View