CVE-2025-2745: AVEVA PI Web API Cross-site Scripting

Published Jun 12, 2025

Updated

A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that will be executed by users who were socially engineered to disable content security policy protections while rendering annotation attachments from within a web browser.

Affected Software

1 affected component

: AVEVA PI Web API: Versions 2023 SP1 and prior

Remediation

Information

AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Users of affected product versions should apply security updates to mitigate the risk of exploit. From OSISoft Customer Portal https://my.osisoft.com/ , search for "PI Web API" and select version 2023 SP1 Patch 1 or higher. For additional information please refer to AVEVA-2025-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .

Event History

Jun 12, 2025

CVE Published

via MITRE·07:42 PM

Data Sourced

via MITRE·07:42 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-162-08

Frequently Asked Questions

What is the severity of CVE-2025-2745?

CVE-2025-2745 is considered a high severity cross-site scripting vulnerability.

Who is affected by CVE-2025-2745?

CVE-2025-2745 affects users of AVEVA PI Web API versions 2023 SP1 and prior.

How do I fix CVE-2025-2745?

To mitigate CVE-2025-2745, it is recommended to upgrade to the latest version of AVEVA PI Web API not affected by this vulnerability.

What type of attack can CVE-2025-2745 enable?

CVE-2025-2745 can allow an authenticated attacker to persist arbitrary JavaScript code in the application.

What are the potential consequences of exploiting CVE-2025-2745?

Exploitation of CVE-2025-2745 could lead to unauthorized actions carried out under the privileges of the authenticated user.