PT-2017-9001
CVE-2016-6603
·
Published
2017-01-23
·
Updated
2018-10-09
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
ZOHO WebNMS Framework versions 5.2 and 5.2 SP1
Description
The issue allows remote attackers to bypass authentication and impersonate arbitrary users via the
UserName HTTP header.Recommendations
For ZOHO WebNMS Framework versions 5.2 and 5.2 SP1, consider restricting access to the
UserName HTTP header until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploitability
Exploit
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾