CVE-2017-5153: High severity OSIsoft PI Coresight vulnerability
An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords to become exposed for the affected services, potentially leading to unauthorized shutdown of the affected PI services as well as potential reuse of domain credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5153?
CVE-2017-5153 has a severity rating that indicates a moderate risk primarily related to information exposure.
How do I fix CVE-2017-5153?
To fix CVE-2017-5153, you should upgrade to a version of OSIsoft PI Coresight or PI Web API later than 2016 R2 that addresses the vulnerability.
What is the impact of CVE-2017-5153?
The impact of CVE-2017-5153 includes potential unauthorized access to service account passwords through server log files.
Which versions are affected by CVE-2017-5153?
CVE-2017-5153 affects OSIsoft PI Coresight versions up to and including 2016 R2 and PI Web API version 2016 R2.
Who should be concerned about CVE-2017-5153?
Organizations using OSIsoft PI Coresight or PI Web API versions up to 2016 R2 should be concerned about CVE-2017-5153.