CVE-2020-25623

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 22.3.x through 22.3.4.5 Erlang/OTP versions 23.x through 23.0

Description The issue allows an attacker to send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used. This is related to directory traversal due to insufficient path name restrictions. An attacker can exploit this to gain access to confidential data.

Recommendations For Erlang/OTP versions 22.3.x through 22.3.4.5, update to version 22.3.4.6 or later. For Erlang/OTP versions 23.x through 23.0, update to version 23.1 or later. As a temporary workaround, consider restricting access to the httpd in the inets application until a patch is available.