CVE-2020-25167 OSIsoft PI Vision Incorrect Authorization
Attackers with insufficient privileges can access sensitive AF attribute information in OSIsoft PI Vision, requiring an upgrade to secure data access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-25167?
CVE-2020-25167 is a medium-severity missing authorization vulnerability in OSIsoft PI Vision, published on 18 Apr 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OSIsoft PI Vision 2020 versions prior to 3.5.0 could disclose information to a user with insufficient privileges for an AF attribute.
Weakness: CWE-863
Which versions are affected by CVE-2020-25167?
It affects 1 product.
Products include Osisoft Pi Vision.
How do I fix CVE-2020-25167?
No fix has been published for CVE-2020-25167 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-25167 being exploited?
There is no known exploitation of CVE-2020-25167 in the wild and no public exploit code.
Other vulnerabilities in OSIsoft PI Vision
Sources
Also known as GHSA-p35j-ggp6-r35x.