CVE-2007-5289 HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows rem...
HighCVSS 7.6
EPSS 8.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\TD_80, and then setting the file's properties to read-only.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HP Inc mercury quality center | <= 9.2 | No fix listed |
| HP Inc mercury quality center | = 8.0 | No fix listed |
| HP Inc mercury quality center | = 8.2 | No fix listed |
| HP Inc mercury quality center | = 8.2-sp1 | No fix listed |
| HP Inc mercury quality center | = 9.0 | No fix listed |
| HP Inc testdirector | All versions | No fix listed |
References
- blogs.exposit.co.uk
- 34015 third-party-advisory vendor-advisory
- 34046 third-party-advisory
- VU#898865 third-party-advisory us-government-resource
- 20090223 HP Quality Center vulnerability mailing-list
- 20090224 Re: HP Quality Center vulnerability mailing-list
- 33854 vdb-entry
- hpqualitycenter-workflowscripts-sec-bypass(48860) vdb-entry