1. Home
  2. CVE Database
  3. CVE-2023-48249
MEDIUM · 6.5

CVE-2023-48249

The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By a...

Vulnerability Description

The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
BoschNexo-Os>= 1000, <= 1500-sp2
BoschNexo Cordless Nutrunner Nxa011S-36V-B \(0608842012\)-
BoschNexo Cordless Nutrunner Nxa011S-36V \(0608842011\)-
BoschNexo Cordless Nutrunner Nxa015S-36V-B \(0608842006\)-
BoschNexo Cordless Nutrunner Nxa015S-36V \(0608842001\)-
BoschNexo Cordless Nutrunner Nxa030S-36V-B \(0608842007\)-
BoschNexo Cordless Nutrunner Nxa030S-36V \(0608842002\)-
BoschNexo Cordless Nutrunner Nxa050S-36V-B \(0608842008\)-
BoschNexo Cordless Nutrunner Nxa050S-36V \(0608842003\)-
BoschNexo Cordless Nutrunner Nxa065S-36V-B \(0608842014\)-
BoschNexo Cordless Nutrunner Nxa065S-36V \(0608842013\)-
BoschNexo Cordless Nutrunner Nxp012Qd-36V-B \(0608842010\)-
BoschNexo Cordless Nutrunner Nxp012Qd-36V \(0608842005\)-
BoschNexo Cordless Nutrunner Nxv012T-36V-B \(0608842016\)-
BoschNexo Cordless Nutrunner Nxv012T-36V \(0608842015\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2272\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2301\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2514\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2515\)-
BoschNexo Special Cordless Nutrunner \(0608Pe2666\)-

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2023-48249?

CVE-2023-48249 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By a...

How severe is CVE-2023-48249?

CVE-2023-48249 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-48249?

Check the references section above for vendor advisories and patch information. Affected products include: Bosch Nexo-Os, Bosch Nexo Cordless Nutrunner Nxa011S-36V-B \(0608842012\), Bosch Nexo Cordless Nutrunner Nxa011S-36V \(0608842011\), Bosch Nexo Cordless Nutrunner Nxa015S-36V-B \(0608842006\), Bosch Nexo Cordless Nutrunner Nxa015S-36V \(0608842001\).