OSIsoft PI Vision Cross-site Scripting

published 2022-04-18 4 y ago modified 2026-06-17 4 mo ago also EUVD-2020-17854

cvss: 7.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits: 0; none known

A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. This vulnerability affects PI System data and other data accessible with victim’s user permissions.

Patch / fix

fixed in 1

OSIsoft PI Vision 2020

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-315-02 updated 2020-11-10 cvss 7.7

OSIsoft PI Vision

OSIsoft LLC PI Vision 2020 < PI Vision 2020
affected: vendor fix, mitigation “Recommended defensive measures and related configuration settings are described on the OSIsoft customer portal (Login required).” customers.osisoft.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 18 mo ago (2025-04-16)

Exploit prediction

0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.7	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
NVD	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
NVD	2.0	4.9	AV:N/AC:M/Au:S/C:P/I:P/A:N

Affected products

OSIsoft PI Vision

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

cisa.gov /uscert/ics/advisories/icsa-20-315-02
third-party-advisory, us-government-resource

Sources

CVE List CVE-2020-25163
NVD CVE-2020-25163

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary