ICSA-18-072-04

icsaUScisa_csaf_ot

OSIsoft PI Web API

Advisory ansehen veröffentlicht 2018-03-13

ATTENTION: Exploitable remotely/low skill level to exploit.

01

beschreibt (2)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2018-7508USmedium6.1—
A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutralized.
CVE-2018-7500UScritical9.8—
A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (4)

  • MitigationPI Web API

    OSIsoft has released the following alert

    https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00336
  • MitigationPI Web API

    OSIsoft has released the following alert

    https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00336
  • BehobenPI Web API

    OSIsoft recommends that users upgrade to PI Vision 2017 R2 Update 1 or PI AF Services 2017 R2 Update 1, which both address the PI Web API vulnerabilities. OBtain the updates from OSIsoft.

  • BehobenPI Web API

    OSIsoft recommends that users upgrade to PI Vision 2017 R2 Update 1 or PI AF Services 2017 R2 Update 1, which both address the PI Web API vulnerabilities. OBtain the updates from OSIsoft.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan