CVE-2016-6601

Description

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.

References

https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them

http://www.securityfocus.com/bid/92402

http://www.securityfocus.com/archive/1/539159/100/0/threaded

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS