Vulnerabilities Affecting SICK CorivaHub
SICK CorivaHub includes the third-party components Apache Tomcat and MapLibre GL, which are affected by two known vulnerabilities. These vulnerabilities include an improper input validation issue in Apache Tomcat and a vulnerability in MapLibre GL that could allow malicious behavior through custom GUIs. Under certain conditions, successful exploitation could affect the confidentiality, integrity and availability of the affected system. The attack surface associated with the Apache Tomcat vulnerability is significantly reduced by the default product configuration. Nevertheless, SICK recommends updating to CorivaHub 2026.1.2 to remediate both vulnerabilities.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-85061US | — | — | ||
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while r… | ||||
| CVE-2026-65637US | — | — | ||
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 t… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (3)
- BehobenCorivaHub
Users are recommended to upgrade to version 2026.1.2.
- BehobenCorivaHub
Users are recommended to upgrade to version 2026.1.2.
- WorkaroundCorivaHub
Customers may disable the offline map functionality by setting corivaHubOfflineMap.enabled to false in the CorivaHub configuration. This prevents the affected MapLibre GL component from being loaded and mitigates the vulnerability. The workaround is not expected to have a significant impact on normal production operations. Detailed configuration instructions are available in the CorivaHub documentation: https://portal.coriva.io/portal/app/hub-docs?s=main%252F2026.1%252Fdeployment%252Fcluster%252Fconfig-values.html%2523_tile_server
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan