{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-09-30T00:00:00", "descriptions": [{"lang": "en", "value": "PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify information in databases via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc"}, "references": [{"name": "20090930 C4 SCADA Security Advisory - OSISoft PI Server Authentication Weakness", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/506826/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2009-0209", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify information in databases via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20090930 C4 SCADA Security Advisory - OSISoft PI Server Authentication Weakness", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/506826/100/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T04:24:18.236Z"}, "title": "CVE Program Container", "references": [{"name": "20090930 C4 SCADA Security Advisory - OSISoft PI Server Authentication Weakness", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/506826/100/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2009-0209", "datePublished": "2009-10-01T15:00:00", "dateReserved": "2009-01-20T00:00:00", "dateUpdated": "2024-08-07T04:24:18.236Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osisoft:pi_server:*:sp2:32bit_windows:*:*:*:*:*", "matchCriteriaId": "E537E3DE-CF27-43A7-8429-A668D6A98568", "versionEndIncluding": "3.4.375.99", "vulnerable": true}, {"criteria": "cpe:2.3:a:osisoft:pi_server:2.4:*:*:*:*:*:*:*", "matchCriteriaId": "5184AEE5-6726-459D-A9A1-DB50BE60D4DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:osisoft:pi_server:2.6:*:*:*:*:*:*:*", "matchCriteriaId": "929EB927-9953-466A-80EC-9D849A620AE5", "vulnerable": true}, {"criteria": "cpe:2.3:a:osisoft:pi_server:3.4.363.97:*:*:*:*:*:*:*", "matchCriteriaId": "FBE5B6CB-6D07-4B8C-BAE9-E9F153301209", "vulnerable": true}, {"criteria": "cpe:2.3:a:osisoft:pi_server:3.4.370:*:*:*:*:*:*:*", "matchCriteriaId": "D00D4FA3-9531-4030-B492-C1F51E12AE2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:osisoft:pi_server:3.4.375.99:sp2:64bit_windows:*:*:*:*:*", "matchCriteriaId": "E37BC8ED-73BC-4E5A-B4C9-68995D1D2BBD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify information in databases via unspecified vectors."}, {"lang": "es", "value": "PI Server en OSIsoft PI System anterior a v 3.4.380.x no usa adecuadamente el cifrado en el proceso de autenticaci\u00f3n por defecto, lo que permite a atacantes remotos leer o modificar informaci\u00f3n en bases de datos a trav\u00e9s de vectores sin especificar."}], "id": "CVE-2009-0209", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-10-01T15:30:00.217", "references": [{"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/506826/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/506826/100/0/threaded"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "[email protected]", "type": "Primary"}]}

{}