What is CVE-2018-19006?

CVE-2018-19006 is a medium-severity vulnerability in Osisoft Pi Vision, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2019-04-08.

How severe is CVE-2018-19006?

Medium severity. CVSS v3 base score is 4.8 out of 10.

XSS in Osisoft Pi Vision

CVE-2018-19006

OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF users to store JavaScript in AF elements and attributes.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.007 (49.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.

Affected products

Osisoft Pi Vision — versions PI Vision 2017, and PI Vision 2017 R2
Osisoft Pi_vision — versions 2017

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-19006?: CVE-2018-19006 is a medium-severity vulnerability in Osisoft Pi Vision, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2019-04-08.
How severe is CVE-2018-19006?: Medium severity. CVSS v3 base score is 4.8 out of 10.