SICK Package Analytics

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write files without authentication.

Improper Restriction of Excessive Authentication Attempts

SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly.

Path traversal

Path Traversal

Information disclosure to unauthorized user

Sensitive Information Disclosure Through Missing Authentication

Plain Text Transmission of Username and Password in the URL

The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.

Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1. An authorized attacker could access these stored plaintext credentials and gain access to the ftp service. Storing a password in plaintext allows attackers to easily gain access to systems, potentially compromising personal information or other sensitive information.

No brute-force protection

Information Disclosure Through Stacktrace

Missing HTTP Security Headers

Cross Site Scripting: Session Hijacking

Username Disclosure Through Missing Authentication

User Enumeration by excessive error output