Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2019-11897

Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
bosch

Description

A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Bosch IoT Gateway Software

  • unspecified to < 9.3.0affected

ProSyst mBS SDK

  • unspecified to < 8.2.6affected

References