CVE-2012-5897

critical

Description

The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not properly implement the SaveToFile method, which allows remote attackers to write or overwrite arbitrary files via the bstrFileName argument.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/74442

https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-5771

http://www.securityfocus.com/bid/52773

http://www.exploit-db.com/exploits/18672

http://secunia.com/advisories/48566

http://osvdb.org/80664

http://archives.neohapsis.com/archives/bugtraq/2012-03/0155.html

Details

Source: Mitre, NVD

Published: 2012-11-17

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.03826