Vulnerability Report

CVE-2017-5153

Title: Osisoft Pi Web Api Information Disclosure

Information Disclosure

Proof Of Concept

No public PoC currently indexed for CVE-2017-5153.

CWE Category CWE-532

Published Date Feb 13, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 7.8 CVSS v3.0

Exploit Probability (EPSS)

0.37%

Vulnerability Summary

CVE-2017-5153: An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords to become exposed for the affected services, potentially leading to unauthorized shutdown of the affected PI services as well as potential reuse of domain credentials.

Impacted Vendors

osisoft 2

Reference Links

http://www.securityfocus.com/bid/95355 https://ics-cert.us-cert.gov/advisories/ICSA-17-010-01 http://www.securityfocus.com/bid/95355 https://ics-cert.us-cert.gov/advisories/ICSA-17-010-01

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.8

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity LOW

2.1

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:L/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns