VULNERABILITY INTELLIGENCE

CVE-2016-6269

CVSS score9.1 CRITICAL

EPSS probability3.72%

CISA KEVNot currently listed

Published2017-01-30

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allow remote attackers to read and delete arbitrary files via the tmpfname parameter to (1) log_mgt_adhocquery_ajaxhandler.php, (2) log_mgt_ajaxhandler.php, (3) log_mgt_ajaxhandler.php or (4) tf parameter to wcs_bwlists_handler.php.

Weakness classification

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

cve@mitre.org — Exploit, Technical Description, Third Party Advisory
cve@mitre.org — Mitigation, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Patch, Vendor Advisory