CVE-2016-1593: Novell Service Desk import users path traversal allows JSP upload and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution is achievable by an authenticated administrator, public exploit code exists, and EPSS is very high, though the required admin privilege lowers the immediate risk compared to unauthenticated flaws.

What it is

The import users feature in Micro Focus Novell Service Desk before 7.2 fails to sanitize filenames in multipart/form-data POST requests, allowing a .. (dot dot) path traversal. An attacker can write arbitrary JSP files to a web-accessible location and execute them on the server. The flaw is fixed in version 7.2.

Impact

An attacker gains remote code execution with the privileges of the Service Desk application, leading to full compromise of confidentiality, integrity and availability of the host.

Attack surface

Reached over the network via a multipart/form-data POST to a LiveTime.woa URL; the attacker must be an authenticated administrator, and no user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.64142 (99.19th percentile) and public exploit code exists in Exploit-DB, Packet Storm and a Rapid7 Metasploit module, indicating active exploitation is likely.

What to do

• Upgrade Novell Service Desk to version 7.2 or later, which fixes the traversal.
• Restrict administrative access to the import users feature to trusted networks and accounts.
• Validate and sanitize uploaded filenames, rejecting path traversal sequences and non-allowlisted extensions.
• Deploy a WAF rule to block multipart uploads containing .. sequences or .jsp filenames.
• Monitor and restrict write permissions on web-accessible directories.

Detection

• Search web server logs for multipart/form-data POSTs to LiveTime.woa containing .. or .jsp in filenames.
• Monitor for newly created .jsp files in web-accessible directories.
• Alert on unexpected JSP execution or outbound connections from the Service Desk host.
• Review administrator account activity around the import users feature for anomalous uploads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.