Description
A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a malicious website. As a result, a victim may disclose sensitive information to the attacker or be provided with false information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OSIsoft | PI Web API | All versions – ≤ 2019 SPI | — |
Advisories 1
- ICSA-21-313-06 OSIsoft PI Web API CISA ICS & IT advisories · Nov 9, 2021