4.2Media
CVE-2025-49193Missing HTTP Security Headers
Descripción
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).
Debilidad (CWE):
CWE-693
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| SICK AG | Baggage Analytics | < 4.6.3 | |
| SICK AG | Field Analytics | all versions | |
| SICK AG | Logistic Diagnostic Analytics | < 4.6.3 | |
| SICK AG | Media Server | < 1.5 | |
| SICK AG | Package Analytics | < 4.6.3 | |
| SICK AG | Tire Analytics | < 4.6.3 |
Referencias y parches
- https://sick.com/psirt Vendor Advisory
- https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF Broken Link
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices US Government Resource
- https://www.first.org/cvss/calculator/3.1 Not Applicable
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf vendor-advisoryVendor Advisory
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json vendor-advisoryVendor Advisory
Coincidencias CPE (NVD) (6)
cpe:2.3:a:sick:baggage_analytics:*:*:*:*:*:*:*:*cpe:2.3:a:sick:field_analytics:*:*:*:*:*:*:*:*cpe:2.3:a:sick:logistic_diagnostic_analytics:*:*:*:*:*:*:*:*cpe:2.3:a:sick:media_server:*:*:*:*:*:*:*:*< 1.5cpe:2.3:a:sick:package_analytics:*:*:*:*:*:*:*:*cpe:2.3:a:sick:tire_analytics:*:*:*:*:*:*:*:*