PT-2017-16347 · Osisoft · Osisoft Pi Web Api+1

Published 2017-02-13 · Updated 2017-03-16 · CVE-2017-5153

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OSIsoft PI Coresight versions 2016 R2 and earlier OSIsoft PI Web API versions 2016 R2 and earlier

Description An issue has been identified that may expose service account passwords through server log files, potentially leading to unauthorized shutdown of the affected services and reuse of domain credentials.

Recommendations For OSIsoft PI Coresight versions 2016 R2 and earlier, consider restricting access to server log files to minimize the risk of exposure. For OSIsoft PI Web API versions 2016 R2 and earlier, restrict access to server log files until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2017-5153

Affected Products

Osisoft Pi Coresight

Osisoft Pi Web Api

References · 4

• https://osv.dev/vulnerability/CVE-2017-5153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5153 · Security Note
• http://securityfocus.com/bid/95355 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-010-01 · Note