PT-2020-6854
CVE-2020-25623
·
تاريخ النشر
2020-09-23
·
تاريخ التحديث
2025-11-18
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Erlang/OTP versions 22.3.x through 22.3.4.5
Erlang/OTP versions 23.x through 23.0
Description
The issue allows an attacker to send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used. This is related to directory traversal due to insufficient path name restrictions. An attacker can exploit this to gain access to confidential data.
Recommendations
For Erlang/OTP versions 22.3.x through 22.3.4.5, update to version 22.3.4.6 or later.
For Erlang/OTP versions 23.x through 23.0, update to version 23.1 or later.
As a temporary workaround, consider restricting access to the httpd in the inets application until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾