CVE-2022-40976

A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert.vde.com/en/advisories/VDE-2022-044/	Vendor Advisory
https://cert.vde.com/en/advisories/VDE-2022-045/	Vendor Advisory
https://cert.vde.com/en/advisories/VDE-2022-044/	Vendor Advisory
https://cert.vde.com/en/advisories/VDE-2022-045/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:pilz:pas_4000:*:*:*:*:*:*:*:*

cpe:2.3:h:pilz:pss_4000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:pliz:pascal::::::::
	cpe:2.3:a:pliz:pasconnect::::::::
	cpe:2.3:a:pliz:pasmotion::::::::
	cpe:2.3:a:pliz:pnozmulti_configurator:::::long_term_support:::*
	cpe:2.3:a:pliz:pnozmulti_configurator:::::-:::*

History

21 Nov 2024, 07:22

Type	Values Removed	Values Added
References	~~() https://cert.vde.com/en/advisories/VDE-2022-044/ - Vendor Advisory~~	() https://cert.vde.com/en/advisories/VDE-2022-044/ - Vendor Advisory
References	~~() https://cert.vde.com/en/advisories/VDE-2022-045/ - Vendor Advisory~~	() https://cert.vde.com/en/advisories/VDE-2022-045/ - Vendor Advisory

Information

Published : 2022-11-24 10:15

Updated : 2024-11-21 07:22

NVD link : CVE-2022-40976

Mitre link : CVE-2022-40976

CVE.ORG link : CVE-2022-40976

JSON object : View

Products Affected

pliz

pasmotion
pnozmulti_configurator
pascal
pasconnect

pilz

pas_4000
pss_4000

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2022-40976", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-11-24T10:15:10.530", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-044/", "tags": ["Vendor Advisory"], "source": "info@cert.vde.com"}, {"url": "https://cert.vde.com/en/advisories/VDE-2022-045/", "tags": ["Vendor Advisory"], "source": "info@cert.vde.com"}, {"url": "https://cert.vde.com/en/advisories/VDE-2022-044/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert.vde.com/en/advisories/VDE-2022-045/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de path traversal en varios productos de Pilz. Un atacante local no autenticado podr\u00eda utilizar un archivo de configuraci\u00f3n malicioso comprimido para activar escrituras de archivos arbitrarios (\"zip-slip\"). Las escrituras de archivos no afectan la confidencialidad ni la disponibilidad."}], "lastModified": "2024-11-21T07:22:20.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:pilz:pas_4000:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3582EE4B-DB57-4DE2-B996-70989FD0C382", "versionEndExcluding": "1.25.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:pilz:pss_4000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "670D7E93-F5CE-4525-9CF8-F985FD491FE8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pliz:pascal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76937494-10AA-4666-9613-D70F79F39DBC", "versionEndIncluding": "1.9.1"}, {"criteria": "cpe:2.3:a:pliz:pasconnect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C03F704-A5FB-4813-81AB-1B0EC85A8B92", "versionEndExcluding": "1.4.0"}, {"criteria": "cpe:2.3:a:pliz:pasmotion:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43AE962D-8D55-4BA2-AEB9-3F55085671B7", "versionEndExcluding": "1.4.1"}, {"criteria": "cpe:2.3:a:pliz:pnozmulti_configurator:*:*:*:*:long_term_support:*:*:*", "vulnerable": true, "matchCriteriaId": "0B07EEA2-1AD4-49EB-B644-72A1F0CE3AF1", "versionEndExcluding": "10.14.4"}, {"criteria": "cpe:2.3:a:pliz:pnozmulti_configurator:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "6A1B91BA-0E87-4F60-B11C-5EDC16AD1C0A", "versionEndExcluding": "11.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "info@cert.vde.com"}