Pegasystems Vulnerabilities and Affected Products
Vulnerabilities associated with Pega Platform.
Products
Clear product- Pega Infinity29 vulnerabilities
- Pega Platform10 vulnerabilities
- RPA: Synchronization Engine3 vulnerabilities
- Pega Robot Studio2 vulnerabilities
- Pega Browser Extension (PBE)1 vulnerability
- pega_infinity1 vulnerability
- pega_platform1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-50168HIGH | Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. CWE-611Mar 14, 2024 | CVSS7.7v3.1 | EPSS0.392% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-50167MEDIUM | Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content. CWE-79Mar 6, 2024 | CVSS5.4v3.1 | EPSS0.298% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-50166MEDIUM | Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. CWE-79Jan 31, 2024 | CVSS6.1v3.1 | EPSS0.336% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-50165HIGH | Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents. CWE-918Jan 31, 2024 | CVSS8.5v3.1 | EPSS0.338% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32089MEDIUM | Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description CWE-79Oct 18, 2023 | CVSS4.6v3.1 | EPSS0.298% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32088MEDIUM | Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation CWE-79Oct 18, 2023 | CVSS4.6v3.1 | EPSS0.298% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32087MEDIUM | Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation CWE-79Oct 18, 2023 | CVSS4.6v3.1 | EPSS0.298% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-4843MEDIUM | Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user. | CVSS4.3v3.1 | EPSS0.295% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32090CRITICAL | Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials | CVSS9.8v3.1 | EPSS0.621% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-28094HIGH | Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials. CWE-1393Jun 22, 2023 | CVSS8.1v3.1 | EPSS0.53% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |