CVE-2018-19006 Cross-site scripting in PI Vision

What is CVE-2018-19006?

CVE-2018-19006 is a medium-severity cross-site scripting vulnerability in OSIsoft PI Vision, published on 8 Apr 2019. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF users to store JavaScript in AF elements and attributes.

Weakness: CWE-79

Which versions are affected by CVE-2018-19006?

It affects 1 product.

Products include Osisoft Pi Vision.

How do I fix CVE-2018-19006?

No fix has been published for CVE-2018-19006 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-19006 being exploited?

There is no known exploitation of CVE-2018-19006 in the wild and no public exploit code.

Other vulnerabilities in OSIsoft PI Vision

• CVE-2018-7500 Privilege escalation in OSIsoft PI Web API Critical 9.8
• CVE-2019-18271 Cross-site request forgery in OSIsoft PI Vision High 8.8
• CVE-2020-25163 OSIsoft PI Vision Cross-site Scripting High 7.7
• CVE-2021-43551 OSIsoft PI Vision Medium 6.5
• CVE-2020-10643 OSIsoft PI System Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-98q6-h3hw-m246.