QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2020-6767

Back to search

CVE-2020-6767

Published: Feb 6, 2020

Modified: Sep 16, 2024

PUBLISHED

CVSS v3.1

7.7

HIGH

Description

A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.

VendorProductVersions

Bosch

DIVAR IP 3000

affected
All

Bosch

DIVAR IP 7000

affected
All

Bosch

DIVAR IP all-in-one 5000

affected
All

Bosch

Bosch Video Management System

affected
7.0 and older
affected
7.5 and older
affected
8.0 through 8.0.0.329
affected
9.0 through 9.0.0.827
affected
10.0 through 10.0.0.1225

Bosch

BVMS Viewer

affected
7.0 and older
affected
7.5 and older
affected
8.0 through 8.0.0.329
affected
9.0 through 9.0.0.827
affected
10.0 through 10.0.0.1225

Weaknesses (CWE)

CWE-22

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now