CVE-2019-11897

Published: Aug 21, 2019Modified: Jun 17, 2026

8.6

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 4.0

Source: NVD

Description

A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.

Affected (2)

Products: Bosch: Iot Gateway Software, Prosyst Mbs Sdk

2 products

Iot Gateway Software

Prosyst Mbs Sdk

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Bosch Iot Gateway Software	Before 9.3.0
Bosch Prosyst Mbs Sdk	Before 8.2.6

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html

Source: psirt@bosch.com

Vendor Advisory

https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.