VULNERABILITY INTELLIGENCE

CVE-2018-19006

CVSS score4.8 MEDIUM

EPSS probability0.69%

CISA KEVNot currently listed

Published2019-04-08

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF users to store JavaScript in AF elements and attributes.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

ics-cert@hq.dhs.gov — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource