CVE-2016-6600

Description

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.

References

https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them

http://www.securityfocus.com/bid/92402

http://www.securityfocus.com/archive/1/539159/100/0/threaded

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS