OSIsoft PI Web API 2019
Successful exploitation of this vulnerability could allow a remote authenticated attacker with write access to a PI Server to trick a user into interacting with a PI Web API endpoint that executes arbitrary JavaScript in the user 's browser, resulting in view, modification, or deletion of data as allowed for by the victim 's user permissions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-12021US | critical9.0 | — | ||
In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allow an attacker to remo… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- MitigationPI Web API 2019
Avoid adding authentication type anonymous in PI Web API configuration settings to limit exposure to authenticated users only.
- BehobenPI Web API 2019
OSIsoft recommends affected users upgrade to PI Web API 2019 SP1.= OSIsoft also recommends affected users implement the following measures to reduce exploitation:
https://customers.osisoft.com/s/knowledgearticle?knowledgeArticleUrl=000028352
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan