Details of VAR-202011-1506

ID

VAR-202011-1506

CVE

CVE-2020-25163

TITLE

OSIsoft of OSIsoft PI Vision Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-017700

DESCRIPTION

A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. This vulnerability affects PI System data and other data accessible with victim’s user permissions. OSIsoft of OSIsoft PI Vision Exists in a cross-site scripting vulnerability.Information may be obtained and information may be tampered with

Trust: 1.71

sources: NVD: CVE-2020-25163 // JVNDB: JVNDB-2020-017700 // VULMON: CVE-2020-25163

AFFECTED PRODUCTS

vendor:	osisoft	model:	pi vision	scope:	lt	version:	2020	Trust: 1.0
vendor:	osisoft	model:	pi vision	scope:	eq	version:	-	Trust: 0.8
vendor:	osisoft	model:	pi vision	scope:	-	version:	-	Trust: 0.8
vendor:	osisoft	model:	pi vision	scope:	eq	version:	2020	Trust: 0.8

sources: JVNDB: JVNDB-2020-017700 // NVD: CVE-2020-25163

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-25163
value:	HIGH
Trust: 1.0
ics-cert@hq.dhs.gov:	CVE-2020-25163
value:	HIGH
Trust: 1.0
NVD:	CVE-2020-25163
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202011-847
value:	HIGH
Trust: 0.6
VULMON:	CVE-2020-25163
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-25163
severity:	MEDIUM
baseScore:	4.9
vectorString:	AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

nvd@nist.gov:	CVE-2020-25163
baseSeverity:	HIGH
baseScore:	7.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.1
impactScore:	5.2
version:	3.1
Trust: 1.0
ics-cert@hq.dhs.gov:	CVE-2020-25163
baseSeverity:	HIGH
baseScore:	7.7
vectorString:	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	1.3
impactScore:	5.8
version:	3.1
Trust: 1.0
NVD:	CVE-2020-25163
baseSeverity:	HIGH
baseScore:	7.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULMON: CVE-2020-25163 // JVNDB: JVNDB-2020-017700 // CNNVD: CNNVD-202011-847 // NVD: CVE-2020-25163 // NVD: CVE-2020-25163

PROBLEMTYPE DATA

problemtype:	CWE-79	Trust: 1.0
problemtype:	Cross-site scripting (CWE-79) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-017700 // NVD: CVE-2020-25163

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202011-847

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202011-847

PATCH

title:

OSIsoft PI Fixes for cross-site scripting vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=133829

Trust: 0.6

sources: CNNVD: CNNVD-202011-847

EXTERNAL IDS

db:	NVD	id:	CVE-2020-25163	Trust: 3.3
db:	ICS CERT	id:	ICSA-20-315-02	Trust: 2.5
db:	JVN	id:	JVNVU97890337	Trust: 0.8
db:	JVNDB	id:	JVNDB-2020-017700	Trust: 0.8
db:	AUSCERT	id:	ESB-2020.4027	Trust: 0.6
db:	CNNVD	id:	CNNVD-202011-847	Trust: 0.6
db:	VULMON	id:	CVE-2020-25163	Trust: 0.1

sources: VULMON: CVE-2020-25163 // JVNDB: JVNDB-2020-017700 // CNNVD: CNNVD-202011-847 // NVD: CVE-2020-25163

REFERENCES

url:	https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02	Trust: 2.5
url:	https://jvn.jp/vu/jvnvu97890337/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2020-25163	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2020.4027/	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-20-315-02	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2020-25163/	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2020-25163 // JVNDB: JVNDB-2020-017700 // CNNVD: CNNVD-202011-847 // NVD: CVE-2020-25163

SOURCES

db:	VULMON	id:	CVE-2020-25163
db:	JVNDB	id:	JVNDB-2020-017700
db:	CNNVD	id:	CNNVD-202011-847
db:	NVD	id:	CVE-2020-25163

LAST UPDATE DATE

2024-08-14T13:54:25.154000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2020-25163	date:	2022-04-27T00:00:00
db:	JVNDB	id:	JVNDB-2020-017700	date:	2023-07-27T08:20:00
db:	CNNVD	id:	CNNVD-202011-847	date:	2022-04-28T00:00:00
db:	NVD	id:	CVE-2020-25163	date:	2022-04-27T03:21:59.283

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2020-25163	date:	2022-04-18T00:00:00
db:	JVNDB	id:	JVNDB-2020-017700	date:	2023-07-27T00:00:00
db:	CNNVD	id:	CNNVD-202011-847	date:	2020-11-10T00:00:00
db:	NVD	id:	CVE-2020-25163	date:	2022-04-18T17:15:12.230