Missing Security Headers

The BLU-IC2 and BLU-IC4 software versions up to 1.19.5 are missing important security headers that web browsers use to protect against common attacks like clickjacking and data theft. Without these headers, the application is more vulnerable to certain web-based attacks.

Missing security headers (CWE-693) in BLU-IC2 and BLU-IC4 through v1.19.5 fails to implement HTTP response headers such as X-Frame-Options, X-Content-Type-Options, and Content-Security-Policy that mitigate client-side attacks. An attacker can leverage this to perform clickjacking, MIME-type sniffing, or injection attacks without server-enforced protections in place.