Multiple vulnerabilities in OSIsoft PI Web API

Published: 2019-08-13 | Updated: 2019-08-29

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2019-13515 CVE-2019-13516
CWE-ID	CWE-532 CWE-693
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	OSIsoft PI Web API Server applications / Database software
Vendor	OSIsoft

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Inclusion of Sensitive Information in Log Files

EUVDB-ID: #VU20454

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-13515

CWE-ID: CWE-532 - Information Exposure Through Log Files

Exploit availability: No

Description

The vulnerability allows a remote attacker to access sensitive information on a targeted system.

The vulnerability exists due to the information written to log files can be of a sensitive nature or expose sensitive user information. A remote authenticated attacker can disclose sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OSIsoft PI Web API: 2018

CPE2.3

External links

https://www.us-cert.gov/ics/advisories/icsa-19-225-02

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Protection Mechanism Failure

EUVDB-ID: #VU20455

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-13516

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass certain restrictions.

The vulnerability exists due to the cross-site request forgery protection setting that has not taken effect. A local authenticated attacker can bypass certain security restrictions on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OSIsoft PI Web API: 2018

CPE2.3

External links

https://www.us-cert.gov/ics/advisories/icsa-19-225-02

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.