EUVD-2024-54780Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a moderate-to-high real-world risk despite being a confidentiality-only issue (no integrity or availability impact). Key risk factors: (1) CVSS 7.5 with network-accessible attack vector (AV:N) and no authentication requirement (PR:N) makes exploitation trivial from any network position; (2) Low attack complexity (AC:L) indicates no special conditions or user interaction required; (3) The lack of availability/integrity impact reduces severity compared to RCE vulnerabilities, but information disclosure in license servers often enables secondary attacks (license fraud, IP theft, infrastructure reconnaissance); (4) CWE-200 vulnerabilities frequently lead to downstream compromise when sensitive system information is disclosed. Without access to EPSS data or KEV status, the real-world exploitability cannot be confirmed, but the technical characteristics (network-accessible, no auth, simple exploitation) suggest active exploitation is probable if patch adoption is delayed. Organizations should prioritize this based on whether APLS instances are internet-facing or accessible from untrusted networks. |
| Exploit ScenarioDerived | An attacker on the network (either external if APLS is internet-facing, or internal malicious actor) sends unauthenticated HTTP/HTTPS requests to publicly accessible APLS endpoints (e.g., /api/licenses, /status, or similar information endpoints). The APLS service responds with sensitive license metadata including: customer entitlements, license keys, installed software inventory, hardware identifiers, usage data, and system configuration details. The attacker harvests this information to: (1) understand the organization's software licensing posture for social engineering or sales targeting; (2) extract license keys for license fraud or counterfeit software distribution; (3) identify high-value HPE software in use for targeted follow-up attacks; (4) map internal IT infrastructure. The attack requires no authentication, no user interaction, and can be automated for rapid scanning of multiple APLS instances. If public POC exists (not confirmed in provided data), widespread exploitation would be expected within days of disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
CVE-2024-51769 is an information disclosure vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 that allows unauthenticated network attackers to access sensitive information without requiring user interaction. The vulnerability has a CVSS 3.1 score of 7.5 with a high confidentiality impact (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor), making it a significant risk for organizations relying on APLS for license management across their HPE infrastructure.
RemediationAI
Immediate action: Upgrade HPE AutoPass License Server to version 9.17 or later. Organizations unable to immediately patch should: (1) Implement network-level access controls to restrict APLS service accessibility to only authorized administrative users and systems; (2) Deploy APLS instances on isolated internal networks without public internet exposure; (3) Implement firewall rules limiting access to APLS ports (typically 7070, 27000, or custom ports) to trusted IP ranges only; (4) Monitor APLS access logs for suspicious unauthenticated requests; (5) Review APLS security event logs for evidence of information disclosure attempts. Consult the HPE Security Advisory (reference HPE PSRT documentation) for detailed upgrade procedures and rollback plans. Test patches in non-production environments before production deployment given the critical nature of license infrastructure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE AutoPass License Server (APLS) is a centralized license management solution for HPE software and hardware products. The vulnerability stems from improper information exposure (CWE-200), a common weakness class indicating that sensitive data is made accessible to actors without proper authorization controls. The affected product uses network-accessible services (evidenced by CVSS AV:N) that fail to implement adequate access controls or data classification mechanisms. This typically manifests in license server APIs, web interfaces, or backend services that expose confidential licensing metadata, entitlement information, or system configuration details. The lack of authentication requirements (PR:N in CVSS vector) suggests the vulnerability exists in unauthenticated endpoints or services that should require credential validation before responding with sensitive information.
Know when Autopass License Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.
Executive ViewAI
CVE-2024-51769 is an information disclosure vulnerability in HPE AutoPass License Server that exposes sensitive licensing and infrastructure data to unauthenticated network attackers, potentially compromising license compliance records and system configuration details across HPE environments. Organizations using APLS versions prior to 9.17 face immediate risk of data exposure without requiring successful credential compromise or user interaction, directly impacting license management integrity and audit readiness.
Apply vendor patch. Until patching is completed, restrict network access to APLS instances through firewall rules limiting connections to authorized administrators and licensed HPE systems only; disable remote access protocols if not operationally required; implement network segmentation isolating APLS from untrusted networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Autopass License Server
View allRemote authentication bypass in HPE AutoPass License Server (APLS) allows unauthenticated network attackers to circumven
CVE-2024-51768 is a remote code execution vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17, st
CVE-2024-51770 is an information disclosure vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 t
CVE-2024-51767 is an authentication bypass vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 th
GitHub PoC
Exploit-DB