ZDI-CAN-25314: ZDI-25-317: Hewlett Packard Enterprise StoreOnce VSA deletePackages Directory Traversal Arbitrary File Deletion Vulnerability
This vulnerability allows remote attackers to delete arbitrary files on affected installations of Hewlett Packard Enterprise StoreOnce VSA. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2025-37094.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-25314?
ZDI-CAN-25314 is considered a critical vulnerability due to its ability to allow remote file deletion.
How do I fix ZDI-CAN-25314?
To fix ZDI-CAN-25314, ensure that you apply the latest security patches provided by Hewlett Packard Enterprise for StoreOnce VSA.
How can ZDI-CAN-25314 be exploited?
ZDI-CAN-25314 can be exploited by authenticated attackers who can bypass the existing authentication mechanism.
What are the risks associated with ZDI-CAN-25314?
The risks associated with ZDI-CAN-25314 include potential data loss and unauthorized access to sensitive information.
Is authentication required to exploit ZDI-CAN-25314?
Yes, authentication is required to exploit ZDI-CAN-25314, but it can be bypassed.