Summary
Successful exploitation of this vulnerability could allow a remote authenticated attacker with write access to a PI Server to trick a user into interacting with a PI Web API endpoint that executes arbitrary JavaScript in the user 's browser, resulting in view, modification, or deletion of data as allowed for by the victim 's user permissions.
Vulnerabilities 1
-
Unscored —
In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cro…
Revision history
-
#1
ICSA-20-163-01 OSIsoft PI Web API 2019
References
-
ICS Advisory ICSA-20-163-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-20-163-01
-
Recommended Practices
https://www.us-cert.gov/ncas/tips/ST04-014
-
Recommended Practices
https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B