CVE-2018-7529 Deserialization in OSIsoft PI Data Archive
Unauthenticated attackers can crash the OSIsoft PI Data Archive server by sending malicious deserialized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7529?
CVE-2018-7529 is a high-severity unsafe deserialization vulnerability in OSIsoft PI Data Archive, published on 14 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modify deserialized data to send custom requests that crash the server.
Weakness: CWE-502
Which versions are affected by CVE-2018-7529?
It affects 1 product.
Products include Osisoft Pi Data Archive.
How do I fix CVE-2018-7529?
No fix has been published for CVE-2018-7529 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2018-7529 being exploited?
There is no known exploitation of CVE-2018-7529 in the wild and no public exploit code.
Other vulnerabilities in OSIsoft PI Data Archive
Sources
Also known as GHSA-jhf2-5g69-j72p.