PT-2019-9699 · Osisoft · Osisoft Pi Vision

Publicado 2019-04-08 · Atualizado 2019-10-09 · CVE-2018-19006

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OSIsoft PI Vision versions PI Vision 2017 through PI Vision 2017 R2

Description The application contains a cross-site scripting issue where displays that reference AF elements and attributes containing JavaScript are affected. This issue requires the ability of authorized AF users to store JavaScript in AF elements and attributes.

Recommendations For OSIsoft PI Vision versions PI Vision 2017 through PI Vision 2017 R2, consider restricting the ability of authorized AF users to store JavaScript in AF elements and attributes as a temporary workaround until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-19006

Produtos afetados

Osisoft Pi Vision

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-19006 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19006 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-19-043-01 · Nota