CVE-2016-6603
CriticalSummary
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.
Risk Assessment
Attackers can gain access to the system as another user, potentially leading to unauthorized access to data and functions.
Recommendation
It is recommended to update to the latest version of ZOHO WebNMS framework and implement additional security measures to protect against such attacks.
Other vulnerabilities in ZOHO WebNMS Framework 5.2 and 5.2 SP1
See all- CVE-2016-6602Critical
ZOHO WebNMS Framework versions 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, allowing attackers to obtain cleartext passwords by accessing WEB-INF/conf/securitydbData.xml.
- CVE-2016-6600Critical
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter.
Original NVD description (English source)
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.