PT-2020-15281 · Sick · Sick Package Analytics

Published 2020-07-29 · Updated 2021-07-21 · CVE-2020-2076

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SICK Package Analytics software versions up to and including V04.0.0

Description The issue allows for an authentication bypass by directly interacting with the REST API, enabling an attacker to send unauthorized requests and bypass current authentication controls. This could potentially allow writing files without authentication.

Recommendations For versions up to and including V04.0.0, consider restricting access to the REST API as a temporary workaround until a patch is available. Avoid using the API for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-2076

Affected Products

Sick Package Analytics

References · 3

• https://osv.dev/vulnerability/CVE-2020-2076 · Vendor Advisory
• https://sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2076 · Security Note