CVE-2007-5289
- State
- Published
- Severity
- Not scored
- Published
- Feb 24, 2009
- Updated
- Aug 7, 2024
- Reserved
- Oct 9, 2007
Description
HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\TD_80, and then setting the file's properties to read-only.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 34046third-party-advisory
- 20090223 HP Quality Center vulnerabilitymailing-list
- 33854vdb-entry
- 34015third-party-advisory
- hpqualitycenter-workflowscripts-sec-bypass(48860)vdb-entry
- VU#898865third-party-advisory
- 20090224 Re: HP Quality Center vulnerabilitymailing-list
- http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.