CVE-2019-11897 - CVE House

Back to Database

Status published High CVE-2019-11897

Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software

8.6 CVSS

Vulnerability Description

A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11897

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Philip Kazmeier

References

https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html

More from Bosch

View All →

Enabling SSH server on Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU

Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU

Affected Vendor

Bosch

View all reports →

Affected Software

IoT Gateway Software, mBS SDK

Vulnerable Versions:

unspecified

Timeline

Official Publish: August 21st, 2019

Last Modified: September 17th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1046 Network Service Discovery