Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2007-4471 | First vendor Publication | 2007-09-05 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple unspecified vulnerabilities in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to create or overwrite arbitrary files via unspecified arguments to the (1) httpGETToFile, (2) httpPOSTFromFile, and possibly other methods, probably involving path traversal vulnerabilities in exposed dangerous methods. NOTE: this can be leveraged for code execution by writing to a Startup folder. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4471 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-264 | Permissions, Privileges, and Access Controls |
| 50 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 37134 | Intuit QuickBooks Online Edition ActiveX httpGETToFile / httpPOSTFromFile Met... |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Intuit QuickBooks Online Edition 10 ActiveX clsid unicode access RuleID : 12412 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 10 ActiveX clsid access RuleID : 12411 - Revision : 12 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Intuit QuickBooks Online Edition 9 ActiveX clsid unicode access RuleID : 12410 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 9 ActiveX clsid access RuleID : 12409 - Revision : 12 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Intuit QuickBooks Online Edition 8 ActiveX clsid unicode access RuleID : 12408 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 8 ActiveX clsid access RuleID : 12407 - Revision : 12 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Intuit QuickBooks Online Edition 7 ActiveX clsid unicode access RuleID : 12406 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 7 ActiveX clsid access RuleID : 12405 - Revision : 12 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Intuit QuickBooks Online Edition 6 ActiveX clsid unicode access RuleID : 12404 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 6 ActiveX clsid access RuleID : 12403 - Revision : 12 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Intuit QuickBooks Online Edition 5 ActiveX clsid unicode access RuleID : 12402 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 5 ActiveX clsid access RuleID : 12401 - Revision : 12 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Intuit QuickBooks Online Edition 4 ActiveX clsid unicode access RuleID : 12400 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 4 ActiveX clsid access RuleID : 12399 - Revision : 12 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Intuit QuickBooks Online Edition 3 ActiveX clsid unicode access RuleID : 12398 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 3 ActiveX clsid access RuleID : 12397 - Revision : 12 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Intuit QuickBooks Online Edition 2 ActiveX clsid unicode access RuleID : 12396 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 2 ActiveX clsid access RuleID : 12395 - Revision : 12 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Intuit QuickBooks Online Edition 1 ActiveX clsid unicode access RuleID : 12394 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Intuit QuickBooks Online Edition 1 ActiveX clsid access RuleID : 12393 - Revision : 12 - Type : BROWSER-PLUGINS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2007-12-11 | Name : Arbitrary code can be executed on the remote host through the web client. File : smb_nt_ms07-069.nasl - Type : ACT_GATHER_INFO |
| 2007-09-18 | Name : The remote Windows host has an ActiveX control that is affected by various vu... File : quickbooks_10_activex_issues.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:16:22 |
|
| 2024-11-28 12:13:16 |
|
| 2021-05-04 12:06:17 |
|
| 2021-04-22 01:06:50 |
|
| 2020-05-23 00:20:19 |
|
| 2017-07-29 12:02:28 |
|
| 2016-06-28 16:51:05 |
|
| 2016-04-26 16:30:58 |
|
| 2014-02-17 10:41:24 |
|
| 2014-01-19 21:24:23 |
|
| 2013-05-11 10:34:21 |
|
