PT-2017-16347 · Osisoft · Osisoft Pi Web Api+1

Publicado 2017-02-13 · Atualizado 2017-03-16 · CVE-2017-5153

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OSIsoft PI Coresight versions 2016 R2 and earlier OSIsoft PI Web API versions 2016 R2 and earlier

Description An issue has been identified that may expose service account passwords through server log files, potentially leading to unauthorized shutdown of the affected services and reuse of domain credentials.

Recommendations For OSIsoft PI Coresight versions 2016 R2 and earlier, consider restricting access to server log files to minimize the risk of exposure. For OSIsoft PI Web API versions 2016 R2 and earlier, restrict access to server log files until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2017-5153

Produtos afetados

Osisoft Pi Coresight

Osisoft Pi Web Api

Referências · 4

• http://securityfocus.com/bid/95355 · Nota
• https://osv.dev/vulnerability/CVE-2017-5153 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-17-010-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5153 · Nota de Segurança