CVE-2016-6269
CriticalSummary
Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server allow remote attackers to read and delete arbitrary files via the tmpfname parameter in several PHP scripts.
Risk Assessment
Attackers may gain access to sensitive data or delete critical files, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update Trend Micro Smart Protection Server to the latest version to mitigate these vulnerabilities and to monitor logs for potential attack attempts.
Original NVD description (English source)
Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allow remote attackers to read and delete arbitrary files via the tmpfname parameter to (1) log_mgt_adhocquery_ajaxhandler.php, (2) log_mgt_ajaxhandler.php, (3) log_mgt_ajaxhandler.php or (4) tf parameter to wcs_bwlists_handler.php.