CVE-2016-6600: Path Traversal
Published Jan 23, 2017
·Updated
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.
Affected Software
2 affected components
ZohoCorp Webnms Framework=5.2
ZohoCorp Webnms Framework=5.2-sp1
Event History
Jan 23, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-6600?
CVE-2016-6600 is classified as a high severity vulnerability due to its potential to allow remote code execution.
2
How do I fix CVE-2016-6600?
To fix CVE-2016-6600, apply the latest patches for ZOHO WebNMS Framework version 5.2 or 5.2 SP1.
3
What types of attacks can be executed due to CVE-2016-6600?
Attackers can exploit CVE-2016-6600 to upload and execute arbitrary JSP files on the server.
4
Which versions of ZOHO WebNMS Framework are affected by CVE-2016-6600?
CVE-2016-6600 affects ZOHO WebNMS Framework versions 5.2 and 5.2 SP1.
5
Is CVE-2016-6600 a web application vulnerability?
Yes, CVE-2016-6600 is a directory traversal vulnerability within the web application's file upload functionality.