4.8med
CVE-2018-19006
OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where disp…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
4.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 53%
Public exploits
0
none known
Summary
OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF users to store JavaScript in AF elements and attributes.
Exploit prediction (EPSS)
0.69% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 4.8 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- OSIsoft PI Vision
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- ics-cert.us-cert.gov /advisories/ICSA-19-043-01 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-19006
- NVD: CVE-2018-19006
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.