PT-2020-15777 · Hewlett Packard · Hpe Pay Per Use (Ppu) Utility Computing Service (Ucs) Meter

Published 2020-09-08 · Updated 2020-09-29 · CVE-2020-24626

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9

Description The issue concerns an unauthenticated directory traversal vulnerability in the ReceiverServlet class, specifically in the doPost() method. This can lead to arbitrary remote code execution.

Recommendations For HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9, consider restricting access to the ReceiverServlet class until a patch is available. As a temporary workaround, disabling the doPost() method in the ReceiverServlet class may help mitigate the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-24626

ZDI-20-1097

Affected Products

Hpe Pay Per Use (Ppu) Utility Computing Service (Ucs) Meter

References · 4

• https://osv.dev/vulnerability/CVE-2020-24626 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-1097 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24626 · Security Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04037en_us · Vendor Advisory