Arbitrary JSP File Execution via Directory Traversal in ZOHO WebNMS Framework

CVE-2016-6600 · HIGH Severity

AV:N/AC:L/AU:N/C:P/I:P/A:P

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.

Learn more about our Web App Pen Testing.