PT-2020-6854 · Ericsson+1 · Erlang/Otp+1

Published 2020-09-23 · Updated 2025-11-18 · CVE-2020-25623

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 22.3.x through 22.3.4.5 Erlang/OTP versions 23.x through 23.0

Description The issue allows an attacker to send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used. This is related to directory traversal due to insufficient path name restrictions. An attacker can exploit this to gain access to confidential data.

Recommendations For Erlang/OTP versions 22.3.x through 22.3.4.5, update to version 22.3.4.6 or later. For Erlang/OTP versions 23.x through 23.0, update to version 23.1 or later. As a temporary workaround, consider restricting access to the httpd in the inets application until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01663

CVE-2020-25623

OPENSUSE-SU-2024:10740-1

OPENSUSE-SU-2025:15740-1

Affected Products

Astra Linux

Erlang/Otp

References · 20

• https://erlang.org/downloads · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01663 · Security Note
• https://erlang.org/news · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25623 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15740-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10740-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25623 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25623 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25623 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-25623 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25623 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25623 · Vendor Advisory
• https://github.com/erlang/otp/releases/tag/OTP-23.1 · Note
• https://suse.com/security/cve/CVE-2020-25623 · Note