CVE-2019-11897: Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software
A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11897?
CVE-2019-11897 is classified as a medium-severity vulnerability due to its potential to allow remote attackers to forge GET requests.
How do I fix CVE-2019-11897?
To mitigate CVE-2019-11897, upgrade to Bosch IoT Gateway Software version 9.3.0 or ProSyst mBS SDK version 8.2.6 or later.
What software is affected by CVE-2019-11897?
CVE-2019-11897 affects Bosch IoT Gateway Software versions earlier than 9.3.0 and Bosch ProSyst mBS SDK versions earlier than 8.2.6.
What type of vulnerability is CVE-2019-11897?
CVE-2019-11897 is a Server-Side Request Forgery (SSRF) vulnerability.
Could CVE-2019-11897 lead to further exploitation?
Yes, CVE-2019-11897 could potentially allow attackers to access internal systems and sensitive information through forged requests.