ICSA-19-225-02

OSIsoft PI Web API

view advisory published 2019-08-13

Successful exploitation of these vulnerabilities may allow direct attacks against the product and disclose sensitive information.

describes (2)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-13516US	high8.8	0.66% (51st)	—	2019-08-15
In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.
CVE-2019-13515US	medium6.5	1.28% (70th)	—	2019-08-15
OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.

External citations — patches, advisories, analysis.

MitigationPI Web API
Also be sure to clear existing entries in the Debug log.
MitigationPI Web API
Also be sure to clear existing entries in the Debug log.
FixedPI Web API
OSIsoft recommends users upgrade to PI Web API 2018 SP1 or later to resolve these issues. To download PI Web API 2018 SP1, please access the OSIsoft customer portal (login required).
FixedPI Web API
OSIsoft recommends users upgrade to PI Web API 2018 SP1 or later to resolve these issues. To download PI Web API 2018 SP1, please access the OSIsoft customer portal (login required).

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.