Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-40977

PILZ: PASvisu and PMI affected by ZipSlip

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PILZ PASvisu

Default version status: unaffected

  • 1.0.0 to < 1.12.0affected

PILZ PMI v5xx (265507 + 265512)

Default version status: unaffected

  • 1.0.0 to ≤ 1.3.58affected

PILZ PMI v7xx (266704 + 266707)

Default version status: unaffected

  • 1.0.0 to < 2.2.0affected

PILZ PMI v8xx (266807, 266812, 266815)

Default version status: unaffected

  • 1.0.0 to < 1.6.102affected

References