Critical severity · published Jun 23, 2020
CVE-2020-12021
In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allow an attacker to…
9.0
CVSS
1.6%
EPSS
No
On KEV
Description
In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allow an attacker to remotely execute arbitrary code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PW
PI Web Api · Osisoft
through 2019; 2019 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12021
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12021
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-163-01
More from PI Web Api
9.8
CVE-2018-7500
A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior
8.8
CVE-2019-13516
In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect
8.8
CVE-2017-7926
A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0)
7.8
CVE-2017-5153
An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit
6.5
CVE-2019-13515
OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information