Medium severity · published Aug 14, 2017
CVE-2017-9655
A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator…
5.4
CVSS
0.9%
EPSS
No
On KEV
Description
A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a malicious web site.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
PI Integrator For Business Analystics · Osisoft
through 2016 · source: NVD
PI
PI Integrator For Microsoft Azure · Osisoft
through 2016 · source: NVD
PI
PI Integrator For Sap Hana · Osisoft
through 2016 · source: NVD
Affected product
PI
PI Integrator For Business Analystics
Osisoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9655
Third Party Advisory
http://www.securityfocus.com/bid/100212
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-17-220-01
Vendor Advisory
https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00324
More from PI Integrator For Business Analystics
9.8
CVE-2017-9653
An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI…