// For flags

CVE-2017-17478

 

Severity Score

4.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages.

Se ha descubierto un problema de XSS en Designer Studio en Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1 y 7.2.2. Un usuario con credenciales de desarrollador puede insertar código malicioso (hasta 64 caracteres) en un campo de texto en Designer Studio, tras haber establecido el contexto. Designer Studio es el área de trabajo para Pega Platform. La carga útil de XSS se ejecutará cuando otros desarrolladores visiten las páginas afectadas.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-12-08 CVE Reserved
  • 2018-02-27 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Pega
Search vendor "Pega"
 Pega Platform
Search vendor "Pega" for product "Pega Platform"
 7.1.7
Search vendor "Pega" for product "Pega Platform" and version "7.1.7"
-
Affected
Pega
Search vendor "Pega"
 Pega Platform
Search vendor "Pega" for product "Pega Platform"
 7.1.8
Search vendor "Pega" for product "Pega Platform" and version "7.1.8"
-
Affected
Pega
Search vendor "Pega"
 Pega Platform
Search vendor "Pega" for product "Pega Platform"
 7.1.9
Search vendor "Pega" for product "Pega Platform" and version "7.1.9"
-
Affected
Pega
Search vendor "Pega"
 Pega Platform
Search vendor "Pega" for product "Pega Platform"
 7.1.10
Search vendor "Pega" for product "Pega Platform" and version "7.1.10"
-
Affected
Pega
Search vendor "Pega"
 Pega Platform
Search vendor "Pega" for product "Pega Platform"
 7.2
Search vendor "Pega" for product "Pega Platform" and version "7.2"
-
Affected
Pega
Search vendor "Pega"
 Pega Platform
Search vendor "Pega" for product "Pega Platform"
 7.2.1
Search vendor "Pega" for product "Pega Platform" and version "7.2.1"
-
Affected
Pega
Search vendor "Pega"
 Pega Platform
Search vendor "Pega" for product "Pega Platform"
 7.2.2
Search vendor "Pega" for product "Pega Platform" and version "7.2.2"
-
Affected