Path Traversal in Intuit Quickbooks
CVE-2007-4471
Multiple unspecified vulnerabilities in the Intuit QuickBooks Online Edition ActiveX control before 10 allow remote attackers to create or overwrite arbitrary files via unspecified arguments to the (1) httpGETToFile, (2) httpPOSTFromFile, and possibly other methods, probably involving path traversal vulnerabilities in exposed dangerous methods. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.052 (92.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 92.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.052 · newest: 0.052 · change: 0.000
Affected products
Weakness classification (CWE)
References
- exchange.xforce.ibmcloud.com/vulnerabilities/36464 (vdb-entry)
- www.kb.cert.org/vuls/id/979638 (US Government Resource, Patch, Third Party Advisory, third-party-advisory)
- secunia.com/advisories/26659 (third-party-advisory)
- osvdb.org/37134 (vdb-entry)
- www.securityfocus.com/bid/25544 (vdb-entry)