CVE-2019-18244: Medium severity osisoft pi asset framework (af) client vulnerability

Published Jan 15, 2020

Updated

In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files when service accounts are customized during installation or upgrade of PI Vision. The update fixes a previously reported issue.

Affected Software

21 affected components

OSIsoft Applications using PI Asset Framework (AF) Client versions prior to and including PI AF Client 2018 SP3 Patch 1, Version 2.10.7.283

OSIsoft Applications using PI Software Development Kit (SDK) versions prior to and including PI SDK 2018 SP1, Version 1.4.7.602

OSIsoft PI API for Windows Integrated Security versions prior to and including 2.0.2.5,

OSIsoft PI API versions prior to and including 1.6.8.26

OSIsoft PI Buffer Subsystem versions prior to and including 4.8.0.18

OSIsoft PI Connector for BACnet, versions prior to and including 1.2.0.6

OSIsoft PI Connector for CygNet, versions prior to and including 1.4.0.17

OSIsoft PI Connector for DC Systems RTscada, versions prior to and including 1.2.0.42

OSIsoft PI Connector for Ethernet/IP, versions prior to and including 1.1.0.10

OSIsoft PI Connector for HART-IP, versions prior to and including 1.3.0.1

OSIsoft PI Connector for Ping, versions prior to and including 1.0.0.54

OSIsoft PI Connector for Wonderware Historian, versions prior to and including 1.5.0.88

OSIsoft PI Connector Relay, versions prior to and including 2.5.19.0

OSIsoft PI Data Archive versions prior to and including PI Data Archive 2018 SP3, Version 3.4.430.460

OSIsoft PI Data Collection Manager, versions prior to and including 2.5.19.0

OSIsoft PI Integrator for Business Analytics versions prior to and including 2018 R2 SP1, Version 2.2.0.183

OSIsoft PI Interface Configuration Utility (ICU) versions prior to and including 1.5.0.7

OSIsoft PI to OCS versions prior to and including 1.1.36.0

OSIsoft PI Vision=2017-r2

OSIsoft PI Vision=2017-r2_sp1

OSIsoft PI Vision=2019

Event History

Jan 15, 2020

CVE Published

via MITRE·06:50 PM

Data Sourced

via MITRE·06:50 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-20-133-02

Frequently Asked Questions

What is the severity of CVE-2019-18244?

CVE-2019-18244 has been classified as a moderate severity vulnerability.

How do I fix CVE-2019-18244?

To fix CVE-2019-18244, update the affected OSIsoft products to the latest version provided by the vendor.

What products are affected by CVE-2019-18244?

CVE-2019-18244 affects multiple versions of OSIsoft PI Vision and several applications using PI SDK, PI API, and various PI Connectors.

Can CVE-2019-18244 be exploited remotely?

CVE-2019-18244 requires local access to the system, as it is related to sensitive information in log files.

What type of information can be exposed by CVE-2019-18244?

CVE-2019-18244 can expose sensitive information stored in log files due to improper handling of service accounts during installation or upgrade.