CVE-2018-19006 Vulnerability Details

  /     /     /  

CVE-2018-19006 Metadata Quick Info

CVE Published: 08/04/2019 | CVE Updated: 05/08/2024 | CVE Year: 2018
Source: icscert | Vendor: OSIsoft | Product: PI Vision
Status : PUBLISHED

---

CVE-2018-19006 Description

OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF users to store JavaScript in AF elements and attributes.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-79
CWE Name: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ( CROSS-SITE SCRIPTING ) CWE-79
Source: OSIsoft

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).