CVE-2019-11897CWE-918

Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software

High · published August 21, 2019

CVSS v3.0
8.6
EPSS
2%
Percentile
78.1
In the wild
Unconfirmed
What it is

A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.

The record
Technical detail
CVSS v3.0
8.6 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01782 · 78.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2019-08-21T17:09Z
EPSS history
Timeline
  • 21 AUG 17:09Z
    Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software
    cvelistv5