Vulnerabilites related to hp - testdirector
Vulnerability from fkie_nvd
Published
2009-02-24 17:30
Modified
2025-04-09 00:30
Severity ?
Summary
HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\TD_80, and then setting the file's properties to read-only.
References
cve@mitre.orghttp://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/
cve@mitre.orghttp://secunia.com/advisories/34015Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34046
cve@mitre.orghttp://www.kb.cert.org/vuls/id/898865US Government Resource
cve@mitre.orghttp://www.securityfocus.com/archive/1/501177/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/archive/1/501219/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/33854
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/48860
af854a3a-2127-422b-91ae-364da2661108http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34015Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34046
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/898865US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/501177/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/501219/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/33854
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/48860
Impacted products
Vendor Product Version
hp mercury_quality_center *
hp mercury_quality_center 8.0
hp mercury_quality_center 8.2
hp mercury_quality_center 8.2
hp mercury_quality_center 9.0
hp testdirector -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hp:mercury_quality_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6F2EE92-2A3C-4025-8D62-BF8E1F6D1399",
              "versionEndIncluding": "9.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hp:mercury_quality_center:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED5A54FD-8A3B-4163-8862-0089ED9D71F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hp:mercury_quality_center:8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D510F40-6E82-4A04-92C2-BB1D31270384",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hp:mercury_quality_center:8.2:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "BA438217-B2C1-4391-9CFE-A902F01F1C0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hp:mercury_quality_center:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C357686A-D5A5-439A-A14A-FF5B53F0CCEF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hp:testdirector:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "25C39FEB-0210-4E8C-8F9B-DA2D0CAD2699",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement \"workflow\" and decisions about the \"capability\" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\\TD_80, and then setting the file\u0027s properties to read-only."
    },
    {
      "lang": "es",
      "value": "HP Mercury Quality Center (QC) v9.2 y anteriores, y puede que tambi\u00e9n TestDirector; dependen de las secuencias de comandos cacheadas en el lado del cliente para implementar el \"flujo de trabajo\" y decisiones sobre la \"capacidad\" de un usuario; esto permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un uso manipulado de la API de Open Test Arquitecture (OTA), tal y como se ha demostrado modificando (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds o (6) testplan.tds de %tmp%\\TD_80, y luego configurando las propiedades de los ficheros a solo-lectura."
    }
  ],
  "id": "CVE-2007-5289",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.6,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-02-24T17:30:00.390",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34015"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/34046"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/898865"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/501177/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/501219/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/33854"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48860"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34015"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/34046"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/898865"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/501177/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/501219/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/33854"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48860"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2007-5289 (GCVE-0-2007-5289)
Vulnerability from cvelistv5
Published
2009-02-24 17:00
Modified
2024-08-07 15:24
Severity ?
CWE
  • n/a
Summary
HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\TD_80, and then setting the file's properties to read-only.
References
http://secunia.com/advisories/34046third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/archive/1/501177/100/0/threadedmailing-list, x_refsource_BUGTRAQ
http://www.securityfocus.com/bid/33854vdb-entry, x_refsource_BID
http://secunia.com/advisories/34015third-party-advisory, x_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/48860vdb-entry, x_refsource_XF
http://www.kb.cert.org/vuls/id/898865third-party-advisory, x_refsource_CERT-VN
http://www.securityfocus.com/archive/1/501219/100/0/threadedmailing-list, x_refsource_BUGTRAQ
http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/x_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:24:42.477Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "34046",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34046"
          },
          {
            "name": "20090223 HP Quality Center vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/501177/100/0/threaded"
          },
          {
            "name": "33854",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33854"
          },
          {
            "name": "34015",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34015"
          },
          {
            "name": "hpqualitycenter-workflowscripts-sec-bypass(48860)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48860"
          },
          {
            "name": "VU#898865",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/898865"
          },
          {
            "name": "20090224 Re: HP Quality Center vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/501219/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-02-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement \"workflow\" and decisions about the \"capability\" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\\TD_80, and then setting the file\u0027s properties to read-only."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "34046",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34046"
        },
        {
          "name": "20090223 HP Quality Center vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/501177/100/0/threaded"
        },
        {
          "name": "33854",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33854"
        },
        {
          "name": "34015",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34015"
        },
        {
          "name": "hpqualitycenter-workflowscripts-sec-bypass(48860)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48860"
        },
        {
          "name": "VU#898865",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/898865"
        },
        {
          "name": "20090224 Re: HP Quality Center vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/501219/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-5289",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement \"workflow\" and decisions about the \"capability\" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\\TD_80, and then setting the file\u0027s properties to read-only."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "34046",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34046"
            },
            {
              "name": "20090223 HP Quality Center vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/501177/100/0/threaded"
            },
            {
              "name": "33854",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/33854"
            },
            {
              "name": "34015",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34015"
            },
            {
              "name": "hpqualitycenter-workflowscripts-sec-bypass(48860)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48860"
            },
            {
              "name": "VU#898865",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/898865"
            },
            {
              "name": "20090224 Re: HP Quality Center vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/501219/100/0/threaded"
            },
            {
              "name": "http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/",
              "refsource": "MISC",
              "url": "http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-5289",
    "datePublished": "2009-02-24T17:00:00",
    "dateReserved": "2007-10-09T00:00:00",
    "dateUpdated": "2024-08-07T15:24:42.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}