SB2016101307 - Access bypass in OSIsoft PI Web API
Published: October 13, 2016 Updated: October 14, 2016
Security Bulletin ID
SB2016101307
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Access bypass (CVE-ID: CVE-2016-8353)
The vulnerability allows a remote authenticated user to gain access to the IP system on the target system.The weakness exists due to insufficient access control. If the service account user has elevated privileges, it's possible to obtain the PI System with no permission.
Successful exploitation of the vulnerability results in access to the IP system on the vulnerable system.
Remediation
Install update from vendor's website.