PT-2020-15775
CVE-2020-24624
·
تاريخ النشر
2020-09-08
·
تاريخ التحديث
2020-09-29
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9
Description
The issue concerns an unauthenticated directory traversal vulnerability in the DownloadServlet class execute() method. This can lead to arbitrary file reads, potentially disclosing sensitive information.
Recommendations
For HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9, consider restricting access to the DownloadServlet class until a fix is available. As a temporary workaround, disabling the execute() method in the DownloadServlet class may help mitigate the risk of arbitrary file reads.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾