Lucene search

[email protected]CVE-2012-5897

HistoryNov 17, 2012 - 9:55 p.m.

CVE-2012-5897

2012-11-1721:55:04

CWE-264

[email protected]

web.nvd.nist.gov

cve-2012-5897

ardoc activex control

quest intrust

remote attack

file overwrite

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.1 High

AI Score

Confidence

Low

0.076 Low

EPSS

Percentile

94.2%

JSON

The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not properly implement the SaveToFile method, which allows remote attackers to write or overwrite arbitrary files via the bstrFileName argument.

Affected configurations

NVD

Node

questintrustRange≤10.4.0.853

questintrustMatch10.1

questintrustMatch10.2.5

questintrustMatch10.3

questintrustMatch10.4

CPENameOperatorVersion
quest:intrustquest intrustle10.4.0.853
quest:intrustquest intrusteq10.1
quest:intrustquest intrusteq10.2.5
quest:intrustquest intrusteq10.3
quest:intrustquest intrusteq10.4

CPE	Name	Operator	Version
quest:intrust	quest intrust	le	10.4.0.853
quest:intrust	quest intrust	eq	10.1
quest:intrust	quest intrust	eq	10.2.5
quest:intrust	quest intrust	eq	10.3
quest:intrust	quest intrust	eq	10.4

References

archives.neohapsis.com/archives/bugtraq/2012-03/0155.html

osvdb.org/80664

secunia.com/advisories/48566

www.exploit-db.com/exploits/18672

www.securityfocus.com/bid/52773

exchange.xforce.ibmcloud.com/vulnerabilities/74442

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.1 High

AI Score

Confidence

Low

0.076 Low

EPSS

Percentile

94.2%

JSON

Related for CVE-2012-5897

cvelist1 prion1 nvd1