CVE-2019-11897

Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software

State: Published
Severity: 8.6 High
Published: Aug 21, 2019
Updated: Sep 17, 2024
Reserved: May 13, 2019

Description

A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.

Scores

CVSS	Score	Vector	Source
3.0	8.6 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	bosch

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
IoT Gateway SoftwareBosch	before 9.3.0Affected
mBS SDKProSyst	before 8.2.6Affected

References

https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.