Unscored severity · published May 26, 2015
CVE-2015-1013
OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to…
–
CVSS
1.3%
EPSS
No
On KEV
Description
OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
PI Server · Osisoft
2.6 · source: NVD
PS
PI Sql For AF · Osisoft
2.1.2.19 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1013
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01
Vendor Advisory
https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00280
More from PI Server
–
CVE-2009-0209
PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify information…