CVE-2017-9653
critical
CVSS v3
9.8
CVSS v2
7.5
VIR risk
9.8
Description
An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker is able to gain privileged access to the system while unauthorized.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: ics-cert@hq.dhs.gov — https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00324
Vendor advisory: ics-cert@hq.dhs.gov — https://ics-cert.us-cert.gov/advisories/ICSA-17-220-01
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| osisoft | pi_integrator_for_business_analystics | 2016 | |
| osisoft | pi_integrator_for_microsoft_azure | 2016 | |
| osisoft | pi_integrator_for_sap_hana | 2016 | |
References
- http://www.securityfocus.com/bid/100212
- https://ics-cert.us-cert.gov/advisories/ICSA-17-220-01
- https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00324
- http://www.securityfocus.com/bid/100212
- https://ics-cert.us-cert.gov/advisories/ICSA-17-220-01
- https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00324
CWEs
CWE-863
Verify integrity in audit chain (admin only). AS-IS.