CVE-2016-6600
CriticalSummary
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter.
Risk Assessment
Attackers can exploit this vulnerability to upload malicious code, potentially leading to system compromise or data leakage.
Recommendation
It is recommended to upgrade to the latest version of ZOHO WebNMS Framework and implement appropriate security measures against directory traversal attacks.
Other vulnerabilities in ZOHO WebNMS Framework 5.2 and 5.2 SP1
See all- CVE-2016-6603Critical
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.
- CVE-2016-6602Critical
ZOHO WebNMS Framework versions 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, allowing attackers to obtain cleartext passwords by accessing WEB-INF/conf/securitydbData.xml.
Original NVD description (English source)
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.