CVE-2022-40976

A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert.vde.com/en/advisories/VDE-2022-044/	Vendor Advisory
https://cert.vde.com/en/advisories/VDE-2022-045/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:pilz:pss_4000:-:*:*:*:*:*:*:*

cpe:2.3:o:pilz:pas_4000:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:pliz:pascal::::::::
	cpe:2.3:a:pliz:pasconnect::::::::
	cpe:2.3:a:pliz:pasmotion::::::::
	cpe:2.3:a:pliz:pnozmulti_configurator:::::long_term_support:::*
	cpe:2.3:a:pliz:pnozmulti_configurator:::::-:::*

History

No history.

Information

Published : 2022-11-24 10:15

Updated : 2023-02-03 16:13

NVD link : CVE-2022-40976

Mitre link : CVE-2022-40976

CVE.ORG link : CVE-2022-40976

JSON object : View

Products Affected

pilz

pss_4000
pas_4000

pliz

pasmotion
pascal
pasconnect
pnozmulti_configurator

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2022-40976", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-11-24T10:15:10.530", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-044/", "tags": ["Vendor Advisory"], "source": "info@cert.vde.com"}, {"url": "https://cert.vde.com/en/advisories/VDE-2022-045/", "tags": ["Vendor Advisory"], "source": "info@cert.vde.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de path traversal en varios productos de Pilz. Un atacante local no autenticado podr\u00eda utilizar un archivo de configuraci\u00f3n malicioso comprimido para activar escrituras de archivos arbitrarios (\"zip-slip\"). Las escrituras de archivos no afectan la confidencialidad ni la disponibilidad."}], "lastModified": "2023-02-03T16:13:06.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:pilz:pss_4000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "670D7E93-F5CE-4525-9CF8-F985FD491FE8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:pilz:pas_4000:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3582EE4B-DB57-4DE2-B996-70989FD0C382", "versionEndExcluding": "1.25.0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pliz:pascal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76937494-10AA-4666-9613-D70F79F39DBC", "versionEndIncluding": "1.9.1"}, {"criteria": "cpe:2.3:a:pliz:pasconnect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C03F704-A5FB-4813-81AB-1B0EC85A8B92", "versionEndExcluding": "1.4.0"}, {"criteria": "cpe:2.3:a:pliz:pasmotion:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43AE962D-8D55-4BA2-AEB9-3F55085671B7", "versionEndExcluding": "1.4.1"}, {"criteria": "cpe:2.3:a:pliz:pnozmulti_configurator:*:*:*:*:long_term_support:*:*:*", "vulnerable": true, "matchCriteriaId": "0B07EEA2-1AD4-49EB-B644-72A1F0CE3AF1", "versionEndExcluding": "10.14.4"}, {"criteria": "cpe:2.3:a:pliz:pnozmulti_configurator:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "6A1B91BA-0E87-4F60-B11C-5EDC16AD1C0A", "versionEndExcluding": "11.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "info@cert.vde.com"}