PT-2018-18108 · Osisoft · Osisoft Pi Web Api

Published 2018-03-14 · Updated 2019-10-09 · CVE-2018-7500

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OSIsoft PI Web API versions 2017 R2 and prior

Description A Permissions, Privileges, and Access Controls issue was discovered, allowing privileges to be escalated. This escalation gives attackers access to the PI System via the service account.

Recommendations For OSIsoft PI Web API versions 2017 R2 and prior, update to a version later than 2017 R2 to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2018-7500

Affected Products

Osisoft Pi Web Api

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-7500 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7500 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-072-04 · Note
• http://securityfocus.com/bid/103396 · Note