PT-2020-10045 · B&R+1 · Automation Studio+1

Published 2020-04-29 · Updated 2020-05-08 · CVE-2019-19102

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions B&R Automation Studio versions 4.0.x through 4.2.x

Description A directory traversal issue in SharpZipLib, used by the upgrade service, allows unauthenticated users to write to specific local directories. This issue is also referred to as zip slip.

Recommendations For versions 4.0.x through 4.2.x, consider restricting access to the upgrade service until a patch is available. As a temporary workaround, limiting write permissions to sensitive local directories may help minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-19102

Affected Products

Automation Studio

Sharpziplib

References · 3

• https://br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19102 · Security Note