{"schemaVersion":3,"id":"CVE-2021-27471","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can traverse the file system. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the Connected Components Workbench software. User interaction is required for this exploit to be successful.","dates":{"published":"2022-03-23T19:46:37.000Z","modified":"2025-04-16T17:58:57.027Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.6,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.6,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02856,"percentile":0.86552,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.02856},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02856,"percentile":0.86552}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02856,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02856,"percentile":0.86552}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"rockwell automation","product":"connected components workbench","name":"Connected Components Workbench","label":"connected components workbench","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, ≤ v12.00.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, ≤ v12.00.00","eol":null,"hubHref":"/vendor/rockwell_automation/connected_components_workbench"},{"vendor":"rockwellautomation","product":"connected_components_workbench","name":"connected components workbench","label":"connected_components_workbench","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 12.00.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 12.00.00","eol":null,"hubHref":"/vendor/rockwellautomation/connected_components_workbench"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-133-01","label":"www.cisa.gov/uscert/ics/advisories/icsa-21-133-01","hostname":"www.cisa.gov","tags":["X Refsource CONFIRM","Third Party Advisory","US Government Resource"]},{"url":"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435","label":"rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435","hostname":"rockwellautomation.custhelp.com","tags":["X Refsource CONFIRM","Permissions Required","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-03-23T19:46:37.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-04-16T17:58:57.027Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T13:39:44.229Z","stale":false,"partial":false}}