CVE-2007-4471

Multiple unspecified vulnerabilities in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to create or overwrite arbitrary files via unspecified arguments to the (1) httpGETToFile, (2) httpPOSTFromFile, and possibly other methods, probably involving path traversal vulnerabilities in exposed dangerous methods. NOTE: this can be leveraged for code execution by writing to a Startup folder.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://osvdb.org/37134
http://secunia.com/advisories/26659
http://www.kb.cert.org/vuls/id/979638	Patch Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/25544
https://exchange.xforce.ibmcloud.com/vulnerabilities/36464
http://osvdb.org/37134
http://secunia.com/advisories/26659
http://www.kb.cert.org/vuls/id/979638	Patch Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/25544
https://exchange.xforce.ibmcloud.com/vulnerabilities/36464

Configurations

Configuration 1 (hide)

cpe:2.3:a:intuit:quickbooks:*:*:online:*:*:*:*:*

History

21 Nov 2024, 00:35

Type	Values Removed	Values Added
References	~~() http://osvdb.org/37134 -~~	() http://osvdb.org/37134 -
References	~~() http://secunia.com/advisories/26659 -~~	() http://secunia.com/advisories/26659 -
References	~~() http://www.kb.cert.org/vuls/id/979638 - Patch, Third Party Advisory, US Government Resource~~	() http://www.kb.cert.org/vuls/id/979638 - Patch, Third Party Advisory, US Government Resource
References	~~() http://www.securityfocus.com/bid/25544 -~~	() http://www.securityfocus.com/bid/25544 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/36464 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/36464 -

Information

Published : 2007-09-05 19:17

Updated : 2024-11-21 00:35

NVD link : CVE-2007-4471

Mitre link : CVE-2007-4471

CVE.ORG link : CVE-2007-4471

JSON object : View

Products Affected

intuit

quickbooks

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2007-4471", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-09-05T19:17:00.000", "references": [{"url": "http://osvdb.org/37134", "source": "cret@cert.org"}, {"url": "http://secunia.com/advisories/26659", "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/979638", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/25544", "source": "cret@cert.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36464", "source": "cret@cert.org"}, {"url": "http://osvdb.org/37134", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/26659", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.kb.cert.org/vuls/id/979638", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/25544", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36464", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Multiple unspecified vulnerabilities in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to create or overwrite arbitrary files via unspecified arguments to the (1) httpGETToFile, (2) httpPOSTFromFile, and possibly other methods, probably involving path traversal vulnerabilities in exposed dangerous methods. NOTE: this can be leveraged for code execution by writing to a Startup folder."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades no especificadas en el control ActiveX Intuit QuickBooks Online Edition anterior a 10 permite a atacantes remotos crear o sobrescribir ficheros de su elecci\u00f3n mediante argumentos no especificados a (1) httpGETToFile, (2) httpPOSTFromFile, y posiblemente otros m\u00e9todos, que probablemente involucran vulnerabilidades de salto de ruta en m\u00e9todos peligros expuestos. NOTA: esto podr\u00eda ser aprovechado para la ejecuci\u00f3n de c\u00f3digo escribiendo en la carpeta Startup."}], "lastModified": "2024-11-21T00:35:40.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:intuit:quickbooks:*:*:online:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA1D333B-A3F3-409A-9044-8259D8876B2B"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}