CVE-2021-27473
Summary
| CVE | CVE-2021-27473 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-03-23 20:15:00 UTC |
| Updated | 2022-03-29 17:50:00 UTC |
| Description | Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction. This type of vulnerability is also commonly referred to as a Zip Slip. A local, authenticated attacker can create a malicious .ccwarc archive file that, when opened by Connected Components Workbench, will allow the attacker to gain the privileges of the software. If the software is running at SYSTEM level, the attacker will gain admin level privileges. User interaction is required for this exploit to be successful. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Rockwellautomation | Connected Components Workbench | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Sign In | CONFIRM | rockwellautomation.custhelp.com | |
| Rockwell Automation Connected Components Workbench | CISA | CONFIRM | www.cisa.gov | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Mashav Sapir of Claroty reported these vulnerabilities to Rockwell Automation.
There are currently no legacy QID mappings associated with this CVE.