Vulnerability · Published Apr 18, 2022 · Assigned by icscert

CVE-2020-25163OSIsoft PI Vision Cross-site Scripting

High 7.7

In plain English

A high-severity cross-site scripting in PI Vision from OSIsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.9%top 38.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. This vulnerability affects PI System data and other data accessible with victim’s user permissions.

Affected products (as reported)

Vendor	Product	Versions
OSIsoft	PI Vision	unspecified – before 2020

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

References

https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02 x_refsource_CONFIRM