CVE-2012-5897

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-11-17 · updated 2026-06-16
Weakness: CWE-264

Description

The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not properly implement the SaveToFile method, which allows remote attackers to write or overwrite arbitrary files via the bstrFileName argument.

Affected products

Quest Intrust: through 10.4.0.853; 10.1, 10.2.5, 10.3, 10.4

References

http://archives.neohapsis.com/archives/bugtraq/2012-03/0155.html
http://osvdb.org/80664
http://secunia.com/advisories/48566
http://www.exploit-db.com/exploits/18672
http://www.securityfocus.com/bid/52773
https://exchange.xforce.ibmcloud.com/vulnerabilities/74442
http://archives.neohapsis.com/archives/bugtraq/2012-03/0155.html
http://osvdb.org/80664
http://secunia.com/advisories/48566
http://www.exploit-db.com/exploits/18672
http://www.securityfocus.com/bid/52773
https://exchange.xforce.ibmcloud.com/vulnerabilities/74442

Get alerted when CVE-2012-5897 or the next vulnerability affects your stack