CVEvulnerability
CVE-2020-25163
7.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-04-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.7 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
- CVSS 3.1 ([email protected])
- 7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.9 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-79
Description
A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. This vulnerability affects PI System data and other data accessible with victim’s user permissions.
Affected configurations
• osisoft pi vision (< 2020)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02 Third Party Advisory, US Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02 Third Party Advisory, US Government Resource