Description
A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PILZ | PASvisu | 1.0.0 – < 1.12.0 | 1.12.0 |
| PILZ | PMI v5xx (265507 + 265512) | 1.0.0 – ≤ 1.3.58 | — |
| PILZ | PMI v7xx (266704 + 266707) | 1.0.0 – < 2.2.0 | 2.2.0 |
| PILZ | PMI v8xx (266807, 266812, 266815) | 1.0.0 – < 1.6.102 | 1.6.102 |
Advisories 1
- VDE-2022-033 Pilz: PASvisu and PMI affected by multiple vulnerabilities CERT@VDE · Nov 24, 2022