CVE-2022-40977
Assigner: CERTVDE
Published: 2022-11-24T09:20:22.838Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: PASvisu
vendor: PILZ
versions: lessThan: 1.12.0
status: affected
version: 1.0.0
versionType: semver
defaultStatus: unaffected
product: PMI v5xx (265507 + 265512)
vendor: PILZ
versions: lessThanOrEqual: 1.3.58
status: affected
version: 1.0.0
versionType: semver
defaultStatus: unaffected
product: PMI v7xx (266704 + 266707)
vendor: PILZ
versions: lessThan: 2.2.0
status: affected
version: 1.0.0
versionType: semver
defaultStatus: unaffected
product: PMI v8xx (266807, 266812, 266815)
vendor: PILZ
versions: lessThan: 1.6.102
status: affected
version: 1.0.0
versionType: semver
datePublic: 2022-11-24T11:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.<br>
value: A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

impacts: capecId: CAPEC-139
descriptions: value: CAPEC-139 Relative Path Traversal
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: CWE
source: advisory: VDE-2022-033
defect: CERT@VDE#64167
discovery: INTERNAL
title: PILZ: PASvisu and PMI affected by ZipSlip
x_generator: engine: Vulnogram 0.1.0-dev