Path Traversal in Bosch Video Management System (BVMS)
CVE-2020-6767

7.7HIGH

Key Information:

Vendor

Bosch
Status
Divar Ip 3000
Divar Ip 7000
Divar Ip All-in-one 5000
Bosch Video Management System
Vendor
CVE Published:
29 January 2020

What is CVE-2020-6767?

A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.

Affected Version(s)

Bosch Video Management System 7.0 and older

Bosch Video Management System 7.5 and older

Bosch Video Management System 8.0 through 8.0.0.329

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-3814...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.