CVE-2022-40977 — PILZ: PASvisu and PMI affected by ZipSlip

Description (CNA)

A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

Affected (CNA)

Vendor / product	Versions
PILZ / PASvisu	affected 1.0.0 before 1.12.0
PILZ / PMI v5xx (265507 + 265512)	affected 1.0.0 through 1.3.58
PILZ / PMI v7xx (266704 + 266707)	affected 1.0.0 before 2.2.0
PILZ / PMI v8xx (266807, 266812, 266815)	affected 1.0.0 before 1.6.102

CWE

CWE-22

References

https://cert.vde.com/en/advisories/VDE-2022-033/

ADP enrichment

CVE

No English description supplied.

https://cert.vde.com/en/advisories/VDE-2022-033/

CISA-ADP

No English description supplied.

No references supplied.