CVE-2019-8952

Published May 13, 2019

Last updated 5 years ago

Overview

Description: A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote authorized user to access arbitrary files on the system via the network interface. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; 3.70; 3.71 before 3.71.0032 ; fixed versions: 3.71.0032; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; 3.70.0056; fixed versions: 7.5; 3.71.0032).
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.0

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 4
Impact score: 2.9
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: CWE-22

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:bosch:divar_ip_2000_firmware:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "360F7882-2D5C-46ED-A9C6-5A79129C272A",
            "versionEndExcluding": "3.62.0019"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:bosch:divar_ip_2000:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "114BF1E1-4E81-42C3-A563-7C4A523312A4"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:bosch:divar_ip_5000_firmware:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "03229722-C77A-4B16-A90C-E9BA73F4A821",
            "versionEndExcluding": "3.80.0033"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:bosch:divar_ip_5000:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "AB0DE1C9-D3C0-49BF-9FFD-B765F9AF6691"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "640B6AE6-691F-4C75-BD99-254D078D3080",
            "versionEndExcluding": "3.71.0032"
          },
          {
            "criteria": "cpe:2.3:a:bosch:video_recording_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "526B56A8-3106-44C1-8C77-B22995A98C86",
            "versionEndExcluding": "3.71.0032"
          },
          {
            "criteria": "cpe:2.3:a:bosch:video_recording_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DD1FA491-AF37-4C00-A6D6-DFA48DEF426D",
            "versionEndExcluding": "3.81.0032",
            "versionStartIncluding": "3.81"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.0

CVSS 2.0

Weaknesses

Configurations

References