CVE-2007-5289

HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the…

published February 24, 2009

CVSS
—
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\TD_80, and then setting the file's properties to read-only.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08683 · 95.1th percentile
Published
2009-02-24T17:00Z
EPSS history
Timeline
  • 24 FEB 17:00Z
    HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the…
    cvelistv5