OSIsoft PI Web API 2019
Successful exploitation of this vulnerability could allow a remote authenticated attacker with write access to a PI Server to trick a user into interacting with a PI Web API endpoint that executes arbitrary JavaScript in the user 's browser, resulting in view, modification, or deletion of data as allowed for by the victim 's user permissions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-12021US | critical9.0 | — | ||
In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allow an attacker to remo… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- MitigationPI Web API 2019
Avoid adding authentication type anonymous in PI Web API configuration settings to limit exposure to authenticated users only.
- FixedPI Web API 2019
OSIsoft recommends affected users upgrade to PI Web API 2019 SP1.= OSIsoft also recommends affected users implement the following measures to reduce exploitation:
https://customers.osisoft.com/s/knowledgearticle?knowledgeArticleUrl=000028352
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan