NVD

Id
57365  
Name
CVE-2007-5289  
Description
HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%TD_80, and then setting the file"s properties to read-only.  
Reject
 
CVSS Version
2  
CVSS Score
7.6  
Severity
High  
CVSS Base Score
7.6  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-02-24  
Modified Date
2009-03-03  
Seq
2007-5289  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
293108 57365 CVE-2007-5289 http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/  View
293109 57365 CVE-2007-5289 VU#898865  View
293110 57365 CVE-2007-5289 20090223 HP Quality Center vulnerability  View
293111 57365 CVE-2007-5289 20090224 Re: HP Quality Center vulnerability  View
293112 57365 CVE-2007-5289 33854  View
293113 57365 CVE-2007-5289 hpqualitycenter-workflowscripts-sec-bypass(48860)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40368 JVNDB-2009-001374 HP Mercury Quality Center (QC) および TestDirector における任意のコードを実行される脆弱性 HP Mercury Quality Center (QC) および TestDirector には、"workflow" を実装するための、キャッシュされたクライアント側のスクリプト、およびユーザの "capability" の決定を信頼することに起因して、任意のコードを実行される脆弱性が存在します。 CVE-2007-5289 28644 CVE-2007-5289 57365 7.6 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001374.html 2009-02-24 2009-06-30 View