medium5.5
CVE-2022-40976
A path traversal vulnerability was discovered in multiple Pilz products.
Impact
A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pilz | Pas 4000 | before 1.25.0 |
| Pliz | Pascal | through 1.9.1 |
| Pliz | Pasconnect | before 1.4.0 |
| Pliz | Pasmotion | before 1.4.1 |
| Pliz | Pnozmulti Configurator | before 10.14.4 before 11.2.0 |