PT-2020-15776 · Hewlett Packard · Hpe Pay Per Use (Ppu) Utility Computing Service (Ucs) Meter

Published 2020-09-08 · Updated 2020-09-29 · CVE-2020-24625

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9

Description The issue concerns an unauthenticated directory traversal vulnerability in the ReceiverServlet class, specifically in the doGet() method. This can lead to arbitrary file reads, potentially disclosing sensitive information. The vulnerability allows for information disclosure due to the lack of proper authentication and input validation.

Recommendations For HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9, consider restricting access to the ReceiverServlet class until a patch is available. As a temporary workaround, disabling the doGet() method in the ReceiverServlet class can help mitigate the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-24625

ZDI-20-1099

Affected Products

Hpe Pay Per Use (Ppu) Utility Computing Service (Ucs) Meter

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-24625 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24625 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-1099 · Security Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04037en_us · Vendor Advisory