CVE-2019-8951

Published May 13, 2019

Last updated 5 years ago

Overview

Description: An Open Redirect vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote attacker to redirect users to an arbitrary URL. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.70.0056 and newer; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; fixed versions: 7.5; 3.70.0056).
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.0

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 5.8
Impact score: 4.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-601

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:bosch:divar_ip_2000:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "114BF1E1-4E81-42C3-A563-7C4A523312A4"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:bosch:divar_ip_2000_firmware:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "360F7882-2D5C-46ED-A9C6-5A79129C272A",
            "versionEndExcluding": "3.62.0019"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:bosch:divar_ip_5000:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "AB0DE1C9-D3C0-49BF-9FFD-B765F9AF6691"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:bosch:divar_ip_5000_firmware:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "03229722-C77A-4B16-A90C-E9BA73F4A821",
            "versionEndExcluding": "3.80.0033"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2F58C643-F4E4-43FD-A202-907B8F1FBF43",
            "versionEndExcluding": "3.71.0056"
          },
          {
            "criteria": "cpe:2.3:a:bosch:video_recording_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C885C30F-DAD8-4656-BE37-9D298E34C6E1",
            "versionEndExcluding": "3.70.0056"
          },
          {
            "criteria": "cpe:2.3:a:bosch:video_recording_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DD1FA491-AF37-4C00-A6D6-DFA48DEF426D",
            "versionEndExcluding": "3.81.0032",
            "versionStartIncluding": "3.81"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.0

CVSS 2.0

Weaknesses

Configurations

References