CVE-2018-19006 Explained : Impact and Mitigation

OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, contain a cross-site scripting vulnerability affecting displays using AF elements and attributes with JavaScript. Authorized AF users can exploit this vulnerability by storing JavaScript in AF elements and attributes.

Understanding CVE-2018-19006

This CVE involves a security issue in OSIsoft PI Vision versions 2017 and 2017 R2, allowing potential cross-site scripting attacks.

What is CVE-2018-19006?

Vulnerability in OSIsoft PI Vision versions 2017 and 2017 R2
Impact: Cross-site scripting through AF elements and attributes
Requires authorized AF users to store JavaScript in elements

The Impact of CVE-2018-19006

Affected displays using AF elements and attributes with JavaScript
Potential for cross-site scripting attacks

Technical Details of CVE-2018-19006

This section provides technical insights into the vulnerability.

Vulnerability Description

Cross-site scripting vulnerability in OSIsoft PI Vision
Exploitable by authorized AF users storing JavaScript in AF elements

Affected Systems and Versions

OSIsoft PI Vision 2017
OSIsoft PI Vision 2017 R2

Exploitation Mechanism

Authorized AF users with the ability to store JavaScript in AF elements

Mitigation and Prevention

Protect your systems from CVE-2018-19006 with these steps:

Immediate Steps to Take

Disable the capability for AF users to store JavaScript in elements
Regularly monitor and review AF elements and attributes for malicious content

Long-Term Security Practices

Educate users on secure coding practices and the risks of storing JavaScript in elements
Implement strict access controls and permissions for AF elements

Patching and Updates

Apply patches and updates provided by OSIsoft to address the vulnerability