Advisory Details

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Hewlett Packard Enterprise Pay per use UCS Meter. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DownloadServlet class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose files in the context of SYSTEM.

This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 120 day deadline.

04/14/20 - ZDI reported the vulnerability to the vendor
05/05/20 - The vendor confirmed receipt of the report
08/18/20 - ZDI requested an update
08/20/20 - The vendor replied that a fix would be available in September
08/20/20 - ZDI offered an extension until 09/05/2020
08/20/20 - The vendor confirmed that a fix will not be available by 09/05/20
08/31/20 - ZDI notified the vendor of the intention to publish these reports as 0-day advisories on 09/07/2020

-- Mitigation:
Given the nature of the vulnerability the only salient mitigation strategy is to restrict interaction with the application.

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04037en_us

• 2020-04-14 - Vulnerability reported to vendor
• 2020-09-08 - Coordinated public release of advisory
• 2020-10-01 - Advisory Updated