CVE-2018-7500

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI System via the service account.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	OSIsoft PI Web API	OSIsoft PI Web API

References

http://www.securityfocus.com/bid/103396Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-072-04Mitigation, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/103396Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-072-04Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Mar 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-75017.5In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio CVE-2018-75027.8Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer v CVE-2018-75037.5In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio CVE-2018-75046.1A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is no CVE-2018-75059.8In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio CVE-2018-75067.5The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may a CVE-2018-75078.8WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read CVE-2018-75086.1A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is i CVE-2018-75098.8WPLSoft in Delta Electronics versions 2.45.0 and prior writes data from a file outside the bounds of the intended buffer space, which could CVE-2018-75109.8In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords are CVE-2018-75115.3In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in CVE-2018-75126.1A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1