CVE-2016-6601

CVE Database · CVE-2016-6601

CVE-2016-6601

· N/AModified

CVSS v3.1

N/A

EPSS

97.36%

Published

Jan 23, 2017

Modified

May 12, 2026

Public PoC / Exploit (3)

All weaponized →

Exploit-DBWebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.

Weaknesses (CWE)

CWE-22

Affected Products (2)

zohocorp · webnms_frameworkvulnerable

References (20)

http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html

ExploitThird Party Advisory

http://seclists.org/fulldisclosure/2016/Aug/54

ExploitMailing List

http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_cred_disclosure

Third Party Advisory

http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_file_download

Third Party Advisory

http://www.securityfocus.com/archive/1/539159/100/0/threaded

http://www.securityfocus.com/bid/92402

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs