CVE-2023-48249

MEDIUM

Bosch nexo-os < 1500-sp2 - Authenticated Path Traversal via Crafted HTTP Request

Title source: llm
STIX 2.1

Description

The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users.

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0078
EPSS Percentile 51.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
bosch/nexo-os 1000 - 1500-sp2
Published Jan 10, 2024
Tracked Since Feb 18, 2026