CVE-2020-6768

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-6768
A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system_viewer:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:h:bosch:divar_ip_3000:-:*:*:*:*:*:*:*
OR cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:h:bosch:divar_ip_7000:-:*:*:*:*:*:*:*
OR cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:h:bosch:divar_ip_all-in-one_5000:-:*:*:*:*:*:*:*
OR cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
cpe:2.3:a:bosch:video_management_system:*:*:*:*:*:*:*:*
History

No history.

Information

Published : 2020-02-07 21:15

Updated : 2020-02-12 19:43

NVD link : CVE-2020-6768

Mitre link : CVE-2020-6768

CVE.ORG link : CVE-2020-6768

JSON object : View

Products Affected

bosch

  • divar_ip_7000
  • video_management_system_viewer
  • video_management_system
  • divar_ip_all-in-one_5000
  • divar_ip_3000
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')