What is the CVSS score of CVE-2015-1013?

CVE-2015-1013 has a CVSS 2.0 base score of 6.5 (Medium). CVSS vector: AV:N/AC:L/Au:S/C:P/I:P/A:P. EPSS exploitation probability: 0.3%.

Pi Server CVE-2015-1013

MEDIUM

SQL Injection (CWE-89)

2015-05-26 ics-cert@hq.dhs.gov

SQLi Pi Server Pi Sql For Af

6.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/Au:S/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

May 26, 2015 - 01:59 cve.org

MEDIUM 6.5

DescriptionCVE.org

OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.

AnalysisAI

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements. Affected products include: Osisoft Pi Server, Osisoft Pi Sql For Af.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.