PT-2018-6520 · Pegasystems · Pega Platform

Published 2018-02-27 · Updated 2020-08-20 · CVE-2017-17478

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 7.1.7 through 7.1.10 Pega Platform versions 7.2 through 7.2.2

Description: A cross-site scripting (XSS) issue was found in Designer Studio, which is the developer workbench for Pega Platform. This issue allows a user with developer credentials to insert malicious code into a text field, up to 64 characters, after establishing context. The malicious code will execute when other developers visit the affected pages.

Recommendations: For Pega Platform versions 7.1.7 through 7.1.10, restrict access to the Designer Studio text field to minimize the risk of exploitation. For Pega Platform versions 7.2 through 7.2.2, consider disabling the ability to insert code into the Designer Studio text field until a fix is available. Avoid using the affected pages in Designer Studio until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-17478

Affected Products

Pega Platform

References · 3

• https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-17478/pegasystems-security-bulletin-cve-2017-17478 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17478 · Security Note