CVE-2022-27893 Information disclosure in Foundry Magritte plugin osisoft-pi-web-connector
An attacker with log access can view captured authentication requests, potentially exposing credentials in the Foundry Magritte plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-27893?
CVE-2022-27893 is a medium-severity vulnerability in Palantir Foundry Magritte plugin osisoft-pi-web-connector, published on 4 Nov 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that captured authentication requests. This vulnerability is resolved in osisoft-pi-web-connector version 0.44.0.
Weakness: CWE-532
Which versions are affected by CVE-2022-27893?
It affects 1 product.
Products include Osisoft-Pi-Web-Connector Project Osisoft-Pi-Web-Connector.
How do I fix CVE-2022-27893?
No fix has been published for CVE-2022-27893 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-27893 being exploited?
There is no known exploitation of CVE-2022-27893 in the wild and no public exploit code.
Sources
Also known as GHSA-rmq4-54xj-p4fg.