CVE-2021-27471: rockwell automation connected components workbench Path Traversal

Vulnerability summary

CVE-2021-27471 is a high (CVSS 8.6) Path Traversal vulnerability in rockwell automation connected components workbench. EPSS estimates a 2.86% chance of exploitation in the next 30 days, higher than 86.5% of scored vulnerabilities.

Timeline

1. 23-03-2022
   PublishedVulnerability first disclosed.
2. 16-04-2025
   Last modifiedVulnerability information updated.

Description

The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can traverse the file system. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the Connected Components Workbench software. User interaction is required for this exploit to be successful.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.