PT-2019-9699 · Osisoft · Osisoft Pi Vision

Published 2019-04-08 · Updated 2019-10-09 · CVE-2018-19006

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OSIsoft PI Vision versions PI Vision 2017 through PI Vision 2017 R2

Description The application contains a cross-site scripting issue where displays that reference AF elements and attributes containing JavaScript are affected. This issue requires the ability of authorized AF users to store JavaScript in AF elements and attributes.

Recommendations For OSIsoft PI Vision versions PI Vision 2017 through PI Vision 2017 R2, consider restricting the ability of authorized AF users to store JavaScript in AF elements and attributes as a temporary workaround until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-19006

Affected Products

Osisoft Pi Vision

References · 3

• https://osv.dev/vulnerability/CVE-2018-19006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19006 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-043-01 · Note