9.8

CVE-2016-6603

Exploit
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Webnms Framework Version 5.2
Zohocorp ≫ Webnms Framework Version 5.2 Update sp1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 87.04% 0.997
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html
Third Party Advisory
Exploit
VDB Entry
http://seclists.org/fulldisclosure/2016/Aug/54
Third Party Advisory
Exploit
Mailing List
http://www.securityfocus.com/archive/1/539159/100/0/threaded
http://www.securityfocus.com/bid/92402
Third Party Advisory
VDB Entry
https://blogs.securiteam.com/index.php/archives/2712
Third Party Advisory
Exploit
Technical Description
https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them
https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt
Third Party Advisory
Exploit
https://www.exploit-db.com/exploits/40229/
Third Party Advisory
Exploit
VDB Entry