CVE-2020-24624

Name of the Vulnerable Software and Affected Versions HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9

Description The issue concerns an unauthenticated directory traversal vulnerability in the DownloadServlet class execute() method. This can lead to arbitrary file reads, potentially disclosing sensitive information.

Recommendations For HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9, consider restricting access to the DownloadServlet class until a fix is available. As a temporary workaround, disabling the execute() method in the DownloadServlet class may help mitigate the risk of arbitrary file reads.