Lucene search

SICK AGCVE-2020-2077

HistoryJul 29, 2020 - 2:15 p.m.

CVE-2020-2077

2020-07-2914:15:12

CWE-276

SICK AG

web.nvd.nist.gov

sick package analytics

cve-2020-2077

software vulnerability

incorrect permissions

data breach

rest api

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly.

Affected configurations

Nvd

Node

sickpackage_analyticsRange≤04.0.0

VendorProductVersionCPE
sickpackage_analytics*cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sick	package_analytics	*	cpe:2.3:a:sick:package_analytics::::::::

CNA Affected

[
  {
    "product": "SICK Package Analytics",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "<=V04.0.0"
      }
    ]
  }
]

References

www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Related for CVE-2020-2077