CVE-2007-4471

{"id": "CVE-2007-4471", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-09-05T19:17:00.000", "references": [{"url": "http://osvdb.org/37134", "source": "cret@cert.org"}, {"url": "http://secunia.com/advisories/26659", "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/979638", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/25544", "source": "cret@cert.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36464", "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Multiple unspecified vulnerabilities in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to create or overwrite arbitrary files via unspecified arguments to the (1) httpGETToFile, (2) httpPOSTFromFile, and possibly other methods, probably involving path traversal vulnerabilities in exposed dangerous methods. NOTE: this can be leveraged for code execution by writing to a Startup folder."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades no especificadas en el control ActiveX Intuit QuickBooks Online Edition anterior a 10 permite a atacantes remotos crear o sobrescribir ficheros de su elecci\u00f3n mediante argumentos no especificados a (1) httpGETToFile, (2) httpPOSTFromFile, y posiblemente otros m\u00e9todos, que probablemente involucran vulnerabilidades de salto de ruta en m\u00e9todos peligros expuestos. NOTA: esto podr\u00eda ser aprovechado para la ejecuci\u00f3n de c\u00f3digo escribiendo en la carpeta Startup."}], "lastModified": "2017-07-29T01:32:57.677", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:intuit:quickbooks:*:*:online:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA1D333B-A3F3-409A-9044-8259D8876B2B"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}