CVE-2019-18244 Information disclosure in OSIsoft PI System multiple products and versions

What is CVE-2019-18244?

CVE-2019-18244 is a medium-severity vulnerability in OSIsoft PI System multiple products and versions, published on 15 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files when service accounts are customized during installation or upgrade of PI Vision. The update fixes a previously reported issue.

Weakness: CWE-532

Which versions are affected by CVE-2019-18244?

It affects 1 product.

Products include Osisoft Pi Vision.

How do I fix CVE-2019-18244?

No fix has been published for CVE-2019-18244 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-18244 being exploited?

There is no known exploitation of CVE-2019-18244 in the wild and no public exploit code.

Other vulnerabilities in OSIsoft PI System multiple products and versions

• CVE-2018-7500 Privilege escalation in OSIsoft PI Web API Critical 9.8
• CVE-2019-18271 Cross-site request forgery in OSIsoft PI Vision High 8.8
• CVE-2020-25163 OSIsoft PI Vision Cross-site Scripting High 7.7
• CVE-2021-43551 OSIsoft PI Vision Medium 6.5
• CVE-2020-10643 OSIsoft PI System Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3jf8-gh66-pxvp.