{"api_version":"1","generated_at":"2026-07-23T10:16:29+00:00","cve":"CVE-2007-5289","urls":{"html":"https://cve.report/CVE-2007-5289","api":"https://cve.report/api/cve/CVE-2007-5289.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-5289","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-5289"},"summary":{"title":"CVE-2007-5289","description":"HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement \"workflow\" and decisions about the \"capability\" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\\TD_80, and then setting the file's properties to read-only.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-02-24 17:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.6","severity":"","vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:C/I:C/A:C","baseScore":7.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://secunia.com/advisories/34046","name":"http://secunia.com/advisories/34046","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About Secunia Research | Flexera","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/501219/100/0/threaded","name":"http://www.securityfocus.com/archive/1/501219/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/898865","name":"http://www.kb.cert.org/vuls/id/898865","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"CERT Vulnerability Notes Database","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/","name":"http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Functional Testing  » Blog Archive   » Vulnerability in Quality Center","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48860","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48860","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/501177/100/0/threaded","name":"http://www.securityfocus.com/archive/1/501177/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/34015","name":"http://secunia.com/advisories/34015","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About Secunia Research | Flexera","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/33854","name":"http://www.securityfocus.com/bid/33854","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"HP Quality Center Cached Workflow Scripts Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-5289","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-5289","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"5289","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hp","cpe5":"mercury_quality_center","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"5289","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hp","cpe5":"mercury_quality_center","cpe6":"8.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"5289","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hp","cpe5":"mercury_quality_center","cpe6":"8.2","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"5289","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hp","cpe5":"mercury_quality_center","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"5289","vulnerable":"1","versionEndIncluding":"9.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hp","cpe5":"mercury_quality_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"5289","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hp","cpe5":"testdirector","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T15:24:42.477Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"34046","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/34046"},{"name":"20090223 HP Quality Center vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/501177/100/0/threaded"},{"name":"33854","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/33854"},{"name":"34015","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/34015"},{"name":"hpqualitycenter-workflowscripts-sec-bypass(48860)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48860"},{"name":"VU#898865","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/898865"},{"name":"20090224 Re: HP Quality Center vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/501219/100/0/threaded"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-02-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement \"workflow\" and decisions about the \"capability\" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\\TD_80, and then setting the file's properties to read-only."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-15T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"34046","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/34046"},{"name":"20090223 HP Quality Center vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/501177/100/0/threaded"},{"name":"33854","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/33854"},{"name":"34015","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/34015"},{"name":"hpqualitycenter-workflowscripts-sec-bypass(48860)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48860"},{"name":"VU#898865","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/898865"},{"name":"20090224 Re: HP Quality Center vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/501219/100/0/threaded"},{"tags":["x_refsource_MISC"],"url":"http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-5289","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement \"workflow\" and decisions about the \"capability\" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\\TD_80, and then setting the file's properties to read-only."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"34046","refsource":"SECUNIA","url":"http://secunia.com/advisories/34046"},{"name":"20090223 HP Quality Center vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/501177/100/0/threaded"},{"name":"33854","refsource":"BID","url":"http://www.securityfocus.com/bid/33854"},{"name":"34015","refsource":"SECUNIA","url":"http://secunia.com/advisories/34015"},{"name":"hpqualitycenter-workflowscripts-sec-bypass(48860)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48860"},{"name":"VU#898865","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/898865"},{"name":"20090224 Re: HP Quality Center vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/501219/100/0/threaded"},{"name":"http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/","refsource":"MISC","url":"http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-5289","datePublished":"2009-02-24T17:00:00.000Z","dateReserved":"2007-10-09T00:00:00.000Z","dateUpdated":"2024-08-07T15:24:42.477Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-02-24 17:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:C/I:C/A:C","baseScore":7.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":4.9,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:hp:mercury_quality_center:*:*:*:*:*:*:*:*","versionEndIncluding":"9.2","matchCriteriaId":"E6F2EE92-2A3C-4025-8D62-BF8E1F6D1399"},{"vulnerable":true,"criteria":"cpe:2.3:a:hp:mercury_quality_center:8.0:*:*:*:*:*:*:*","matchCriteriaId":"ED5A54FD-8A3B-4163-8862-0089ED9D71F9"},{"vulnerable":true,"criteria":"cpe:2.3:a:hp:mercury_quality_center:8.2:*:*:*:*:*:*:*","matchCriteriaId":"9D510F40-6E82-4A04-92C2-BB1D31270384"},{"vulnerable":true,"criteria":"cpe:2.3:a:hp:mercury_quality_center:8.2:sp1:*:*:*:*:*:*","matchCriteriaId":"BA438217-B2C1-4391-9CFE-A902F01F1C0E"},{"vulnerable":true,"criteria":"cpe:2.3:a:hp:mercury_quality_center:9.0:*:*:*:*:*:*:*","matchCriteriaId":"C357686A-D5A5-439A-A14A-FF5B53F0CCEF"},{"vulnerable":true,"criteria":"cpe:2.3:a:hp:testdirector:-:*:*:*:*:*:*:*","matchCriteriaId":"25C39FEB-0210-4E8C-8F9B-DA2D0CAD2699"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"5289","Ordinal":"1","Title":"CVE-2007-5289","CVE":"CVE-2007-5289","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"5289","Ordinal":"1","NoteData":"HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement \"workflow\" and decisions about the \"capability\" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\\TD_80, and then setting the file's properties to read-only.","Type":"Description","Title":"CVE-2007-5289"},{"CveYear":"2007","CveId":"5289","Ordinal":"2","NoteData":"2009-02-24","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"5289","Ordinal":"3","NoteData":"2018-10-15","Type":"Other","Title":"Modified"}]}}}