Lucene search

[email protected]CVE-2022-40977

HistoryNov 24, 2022 - 10:15 a.m.

CVE-2022-40977

2022-11-2410:15:00

CWE-22

[email protected]

web.nvd.nist.gov

cve-2022-40977

pilz pasvisu server

path traversal

vulnerability

zip-slip

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

47.9%

JSON

A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes (‘zip-slip’). File writes do not affect confidentiality or availability.

CPENameOperatorVersion
pilz:pasvisupilz pasvisult1.12.0
pilz:pmi_v507_firmwarepilz pmi v507 firmwarele1.3.58
pilz:pmi_v512_firmwarepilz pmi v512 firmwarele1.3.58
pilz:pmi_v704e_firmwarepilz pmi v704e firmwarelt2.2.0
pilz:pmi_v707e_firmwarepilz pmi v707e firmwarelt2.2.0
pilz:pmi_v807_firmwarepilz pmi v807 firmwarelt1.6.102
pilz:pmi_v812_firmwarepilz pmi v812 firmwarelt1.6.102
pilz:pmi_v815_firmwarepilz pmi v815 firmwarelt1.6.102

CPE	Name	Operator	Version
pilz:pasvisu	pilz pasvisu	lt	1.12.0
pilz:pmi_v507_firmware	pilz pmi v507 firmware	le	1.3.58
pilz:pmi_v512_firmware	pilz pmi v512 firmware	le	1.3.58
pilz:pmi_v704e_firmware	pilz pmi v704e firmware	lt	2.2.0
pilz:pmi_v707e_firmware	pilz pmi v707e firmware	lt	2.2.0
pilz:pmi_v807_firmware	pilz pmi v807 firmware	lt	1.6.102
pilz:pmi_v812_firmware	pilz pmi v812 firmware	lt	1.6.102
pilz:pmi_v815_firmware	pilz pmi v815 firmware	lt	1.6.102

References

cert.vde.com/en/advisories/VDE-2022-033/

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

47.9%

JSON

Related for CVE-2022-40977

prion1