{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2025-2745", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-03-24T16:30:31.847Z", "datePublished": "2025-06-12T19:42:27.001Z", "dateUpdated": "2025-06-12T20:09:34.976Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "PI Web API", "vendor": "AVEVA", "versions": [ { "lessThanOrEqual": "2023 SP1", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "AVEVA reported this vulnerability to CISA." } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 \nSP1 and prior that, if exploited, could allow an authenticated attacker \n(with privileges to create/update annotations or upload media files) to \npersist arbitrary JavaScript code that will be executed by users who \nwere socially engineered to disable content security policy protections \nwhile rendering annotation attachments from within a web browser." } ], "value": "A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 \nSP1 and prior that, if exploited, could allow an authenticated attacker \n(with privileges to create/update annotations or upload media files) to \npersist arbitrary JavaScript code that will be executed by users who \nwere socially engineered to disable content security policy protections \nwhile rendering annotation attachments from within a web browser." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] }, { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 4.5, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-06-12T19:42:27.001Z" }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-08" }, { "url": "https://www.aveva.com/en/support-and-success/cyber-security-updates/" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

AVEVA recommends that organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.

From OSISoft Customer Portal, search for \"PI Web API\" and select version 2023 SP1 Patch 1 or higher. 
\nFor additional information please refer to AVEVA-2025-003.\n\n

" } ], "value": "AVEVA recommends that organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.\n\nFrom OSISoft Customer Portal https://my.osisoft.com/ , search for \"PI Web API\" and select version 2023 SP1 Patch 1 or higher. \n\nFor additional information please refer to AVEVA-2025-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/ ." } ], "source": { "advisory": "ICSA-25-162-08", "discovery": "INTERNAL" }, "title": "AVEVA PI Web API Cross-site Scripting", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

AVEVA further recommends users follow general defensive measures:

\n
  • for annotation attachments to remove potentially vulnerable of undesired file types (ex: svg, pdf, ...).
    • \n
  • Consider implementing IT policies that would prevent users from \nsubverting/disabling content security policy browser protections.
    • \n
  • Inform PI Web API users that annotation attachments should be \nretrieved through direct REST requests to PI Web API rather than \nrendering them in the browser interface.
    • \n
  • Audit assigned privileges to ensure that only trusted users are given \"Annotate\" access rights

    • For additional information please refer to AVEVA-2025-003.\n\n

    " } ], "value": "AVEVA further recommends users follow general defensive measures:\n\n\n\n * Review and update the file extensions allowlist https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1022248.html \n\n\n * for annotation attachments to remove potentially vulnerable of undesired file types (ex: svg, pdf, ...).\n\n * Consider implementing IT policies that would prevent users from \nsubverting/disabling content security policy browser protections.\n\n * Inform PI Web API users that annotation attachments should be \nretrieved through direct REST requests to PI Web API rather than \nrendering them in the browser interface.\n\n * Audit assigned privileges to ensure that only trusted users are given \"Annotate\" access rights https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1020021.html \nFor additional information please refer to AVEVA-2025-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/ ." } ], "x_generator": { "engine": "Vulnogram 0.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2025-06-12T20:09:20.915656Z", "id": "CVE-2025-2745", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-12T20:09:34.976Z" } } ] } }