Critical severity · published Aug 14, 2017
CVE-2017-9653
An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI…
9.8
CVSS
2.3%
EPSS
No
On KEV
Description
An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker is able to gain privileged access to the system while unauthorized.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
PI Integrator For Business Analystics · Osisoft
2016 · source: NVD
PI
PI Integrator For Microsoft Azure · Osisoft
2016 · source: NVD
PI
PI Integrator For Sap Hana · Osisoft
2016 · source: NVD
Affected product
PI
PI Integrator For Business Analystics
Osisoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9653
Third Party Advisory
http://www.securityfocus.com/bid/100212
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-17-220-01
Vendor Advisory
https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00324
More from PI Integrator For Business Analystics
5.4
CVE-2017-9655
A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator…