CVE-2020-24625

Name of the Vulnerable Software and Affected Versions HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9

Description The issue concerns an unauthenticated directory traversal vulnerability in the ReceiverServlet class, specifically in the doGet() method. This can lead to arbitrary file reads, potentially disclosing sensitive information. The vulnerability allows for information disclosure due to the lack of proper authentication and input validation.

Recommendations For HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9, consider restricting access to the ReceiverServlet class until a patch is available. As a temporary workaround, disabling the doGet() method in the ReceiverServlet class can help mitigate the risk of exploitation.