{"id":"CVE-2019-19102","aliases":["EUVD-2019-8739","GHSA-ww7q-w3g7-9cgc"],"status":"published","title":"Zip Slip vulnerability in 3rd-Party library in  B\u0026R Automation Studio upgrade service","description":"A directory traversal vulnerability in SharpZipLib used in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01277,"percentile":0.70175,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2020-04-29T02:07:47Z","modified":"2026-06-17T02:26:10Z","products":[{"vendor":"b\u0026r","product":"automation studio"},{"vendor":"b\u0026r industrial automation","product":"automation studio"},{"vendor":"br-automation","product":"automation_studio"}],"references":[{"url":"https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19102"},{"url":"https://github.com/advisories/GHSA-ww7q-w3g7-9cgc"}],"sources":{"cve":[{"id":"CVE-2019-19102","title":"Zip Slip vulnerability in 3rd-Party library in  B\u0026R Automation Studio upgrade service","description":"A directory traversal vulnerability in SharpZipLib used in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip.","status":"published","published":"2020-04-29T02:07:47Z","modified":"2024-08-05T02:09:39.123Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-8739","description":"A directory traversal vulnerability in SharpZipLib used in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip.","status":"published","published":"2020-04-29T02:07:47Z","modified":"2024-08-05T02:09:39Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:26.287407Z"}],"ghsa":[{"id":"GHSA-ww7q-w3g7-9cgc","title":"A directory traversal vulnerability in SharpZipLib used in the upgrade service in B\u0026R Automation...","description":"A directory traversal vulnerability in SharpZipLib used in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip.","status":"published","published":"2022-05-24T17:16:49Z","modified":"2023-01-29T05:02:45Z","updated_at":"2026-11-02T14:45:09.48744Z"}],"nvd":[{"id":"CVE-2019-19102","description":"A directory traversal vulnerability in SharpZipLib used in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip.","status":"published","published":"2020-04-29T03:15:16.643Z","modified":"2026-06-17T02:26:10.32Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:46.451008Z"}]}}