CVE-2020-25623: 
Erlang OTP vulnerability analysis and mitigation

A directory traversal vulnerability was identified in Erlang/OTP versions 22.3.x before 22.3.4.6 and 23.x before 23.1. The vulnerability, tracked as CVE-2020-25623, allows an attacker to read arbitrary files by sending crafted HTTP requests when using the httpd module in the inets application (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The issue specifically affects the httpd module within the inets application, allowing path traversal attacks (NVD).

When exploited, this vulnerability allows attackers to read arbitrary files that the Erlang system has read access to through specially crafted HTTP requests. This poses a significant security risk as it could lead to unauthorized access to sensitive system files (Github Release).

The vulnerability can be exploited remotely by sending crafted HTTP requests to systems running the affected versions of Erlang/OTP with the httpd module enabled. The attack requires no authentication or user interaction, making it relatively straightforward to exploit (NVD).

Users should upgrade to Erlang/OTP version 22.3.4.6 or later for the 22.3.x series, or version 23.1 or later for the 23.x series. The vulnerability was introduced in OTP 22.3.1 and corrected in OTP 22.3.4.6, and was also present in OTP 23.0 before being fixed in OTP 23.1 (Ubuntu Security).