Paper/Archive/CVE-2020-24626

CVE-2020-24626

hpe — Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Pe…

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 87.5.875 × 2017.5 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.

Affected

ProductAffectedFixed inSource

HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter1.9–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsupport.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04037en_us