ICSA-19-225-02

OSIsoft PI Web API

Advisory ansehen veröffentlicht 2019-08-13

Successful exploitation of these vulnerabilities may allow direct attacks against the product and disclose sensitive information.

beschreibt (2)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2019-13516US	high8.8	0.66% (51st)	—	2019-08-15
In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.
CVE-2019-13515US	medium6.5	1.28% (70th)	—	2019-08-15
OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

ICS Advisory ICSA-19-225-02 JSONself
ICS Advisory ICSA-19-225-02 Web Versionself
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal

Behebungen (4)

MitigationPI Web API
Also be sure to clear existing entries in the Debug log.
MitigationPI Web API
Also be sure to clear existing entries in the Debug log.
BehobenPI Web API
OSIsoft recommends users upgrade to PI Web API 2018 SP1 or later to resolve these issues. To download PI Web API 2018 SP1, please access the OSIsoft customer portal (login required).
BehobenPI Web API
OSIsoft recommends users upgrade to PI Web API 2018 SP1 or later to resolve these issues. To download PI Web API 2018 SP1, please access the OSIsoft customer portal (login required).

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan