CVE-2016-6601

The document describes multiple vulnerabilities in WebNMS Framework Server 5.2 and 5.2 SP1, including directory traversal leading to RCE, file download via traversal, weak password obfuscation, and user impersonation. CVE-2016-6603 specifically covers user account impersonation via the 'UserName' HTTP header.

This Metasploit module exploits a directory traversal vulnerability in WebNMS Framework Server 5.2 to download arbitrary text files from the filesystem. It uses the FetchFile servlet to perform the traversal attack, with support for both known and brute-forced traversal paths.