CVE-2018-7533

{"id": "CVE-2018-7533", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2018-03-14T18:29:00.780", "references": [{"url": "http://www.securityfocus.com/bid/103399", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-072-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration may allow escalation of privileges that gives the actor full control over the system."}, {"lang": "es", "value": "Se ha descubierto un problema de permisos por defecto incorrectos en OSIsoft PI Data Archive, versiones 2017 R2 y anteriores. La configuraci\u00f3n insegura por defecto podr\u00eda permitir el escalado de privilegios que otorga al actor el control total del sistema."}], "lastModified": "2019-10-09T23:42:23.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:osisoft:pi_data_archive:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFC7AB6E-C67D-460E-A13C-915A759716B2", "versionEndIncluding": "2017"}, {"criteria": "cpe:2.3:a:osisoft:pi_data_archive:2017:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56FD019C-2EE0-49FD-BC97-85D088363D83"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}