CVE-2009-0209

2009-10-0115:30:00

CWE-310

[email protected]

web.nvd.nist.gov

cve-2009-0209

pi server

osisoft

pi system

encryption

authentication

remote attackers

databases

nvd

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.4%

JSON

PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify information in databases via unspecified vectors.

Affected configurations

NVD

Node

osisoftpi_serverRange≤3.4.375.99sp232bit_windows

osisoftpi_serverMatch2.4

osisoftpi_serverMatch2.6

osisoftpi_serverMatch3.4.363.97

osisoftpi_serverMatch3.4.370

osisoftpi_serverMatch3.4.375.99sp264bit_windows

CPENameOperatorVersion
osisoft:pi_serverosisoft pi serverle3.4.375.99
osisoft:pi_serverosisoft pi servereq2.4
osisoft:pi_serverosisoft pi servereq2.6
osisoft:pi_serverosisoft pi servereq3.4.363.97
osisoft:pi_serverosisoft pi servereq3.4.370

CPE	Name	Operator	Version
osisoft:pi_server	osisoft pi server	le	3.4.375.99
osisoft:pi_server	osisoft pi server	eq	2.4
osisoft:pi_server	osisoft pi server	eq	2.6
osisoft:pi_server	osisoft pi server	eq	3.4.363.97
osisoft:pi_server	osisoft pi server	eq	3.4.370