CVE-2009-0209

PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify information in databases via unspecified vectors.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/archive/1/506826/100/0/threaded
http://www.securityfocus.com/archive/1/506826/100/0/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:osisoft:pi_server::sp2:32bit_windows:::::
	cpe:2.3:a:osisoft:pi_server:2.4:::::::*
	cpe:2.3:a:osisoft:pi_server:2.6:::::::*
	cpe:2.3:a:osisoft:pi_server:3.4.363.97:::::::*
	cpe:2.3:a:osisoft:pi_server:3.4.370:::::::*
	cpe:2.3:a:osisoft:pi_server:3.4.375.99:sp2:64bit_windows:::::*

History

21 Nov 2024, 00:59

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/archive/1/506826/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/506826/100/0/threaded -

Information

Published : 2009-10-01 15:30

Updated : 2024-11-21 00:59

NVD link : CVE-2009-0209

Mitre link : CVE-2009-0209

CVE.ORG link : CVE-2009-0209

JSON object : View

Products Affected

osisoft

pi_server

CWE

CWE-310

Cryptographic Issues

{"id": "CVE-2009-0209", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-10-01T15:30:00.217", "references": [{"url": "http://www.securityfocus.com/archive/1/506826/100/0/threaded", "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/archive/1/506826/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify information in databases via unspecified vectors."}, {"lang": "es", "value": "PI Server en OSIsoft PI System anterior a v 3.4.380.x no usa adecuadamente el cifrado en el proceso de autenticaci\u00f3n por defecto, lo que permite a atacantes remotos leer o modificar informaci\u00f3n en bases de datos a trav\u00e9s de vectores sin especificar."}], "lastModified": "2024-11-21T00:59:21.253", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:osisoft:pi_server:*:sp2:32bit_windows:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E537E3DE-CF27-43A7-8429-A668D6A98568", "versionEndIncluding": "3.4.375.99"}, {"criteria": "cpe:2.3:a:osisoft:pi_server:2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5184AEE5-6726-459D-A9A1-DB50BE60D4DE"}, {"criteria": "cpe:2.3:a:osisoft:pi_server:2.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "929EB927-9953-466A-80EC-9D849A620AE5"}, {"criteria": "cpe:2.3:a:osisoft:pi_server:3.4.363.97:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBE5B6CB-6D07-4B8C-BAE9-E9F153301209"}, {"criteria": "cpe:2.3:a:osisoft:pi_server:3.4.370:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D00D4FA3-9531-4030-B492-C1F51E12AE2B"}, {"criteria": "cpe:2.3:a:osisoft:pi_server:3.4.375.99:sp2:64bit_windows:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E37BC8ED-73BC-4E5A-B4C9-68995D1D2BBD"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}