A high-severity information disclosure vulnerability has been identified in Hewlett Packard Enterprise (HPE) AutoPass License Server (APLS). This flaw could allow an unauthenticated remote attacker to access sensitive system information, which could be leveraged for further attacks against the organization. Immediate patching is required to mitigate the risk of a potential data breach and system compromise.

The vulnerability is an information disclosure flaw within the HPE AutoPass License Server. An unauthenticated remote attacker can exploit this by sending a specially crafted request to the APLS server. Successful exploitation results in the server improperly revealing sensitive information, which could include system configurations, license data, or internal network details, without requiring any prior authentication.

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could lead to significant business impact, including the breach of confidential data and intellectual property (e.g., software license keys). The exposed information can provide attackers with critical intelligence for reconnaissance, enabling them to plan more sophisticated attacks, move laterally within the network, or bypass other security controls. This could result in regulatory fines, reputational damage, and operational disruption.

Immediate Action: Immediately apply the vendor-supplied security update to upgrade all instances of HPE AutoPass License Server to version 9.0 or later. Following the update, review server access logs and application logs for any unusual or unauthorized requests that may indicate past or ongoing exploitation attempts.

Proactive Monitoring: Configure monitoring systems to alert on anomalous access patterns to the APLS web interface and API endpoints. Specifically, monitor web server logs for malformed GET/POST requests or requests to non-standard URLs. Network monitoring should be in place to detect any unusual outbound traffic from the APLS server, which could indicate data exfiltration.

Compensating Controls: If immediate patching is not feasible, restrict network access to the APLS management interface to a limited set of trusted IP addresses (e.g., via firewall rules). Consider placing the server behind a Web Application Firewall (WAF) with rules designed to inspect and block malicious requests targeting known application vulnerabilities.

Public Exploit Available: false

Given the high CVSS score and the risk of sensitive data exposure, it is strongly recommended that the organization prioritize the remediation of this vulnerability. All vulnerable HPE AutoPass License Server instances should be patched to version 9.0 or newer within the established patching window for high-severity vulnerabilities. Until patching is complete, apply the recommended compensating controls to reduce the attack surface and monitor for any signs of compromise.