CVE-2018-7504
MEDIUMOSIsoft PI Vision < 2017 - Reflected Cross-Site Scripting via Missing X-XSS-Protection Header
Title source: llmDescription
A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is not set to block, allowing attempts at reflected cross-site scripting.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/103390
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSA-18-072-03
Scores
CVSS v3
6.1
EPSS
0.0085
EPSS Percentile
53.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
CWE-693
Status
published
Products (1)
osisoft/pi_vision
< 2017
Published
Mar 14, 2018
Tracked Since
Feb 18, 2026