« Volver al listado

CVE-2017-17478

Estado: ModificadaMedia (4.8)—

An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pega — Pega Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-17478",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-02-27T15:29:00.443",
  "references": [
    {
      "url": "https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-17478/pegasystems-security-bulletin-cve-2017-17478",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-17478/pegasystems-security-bulletin-cve-2017-17478",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema de XSS en Designer Studio en Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1 y 7.2.2. Un usuario con credenciales de desarrollador puede insertar código malicioso (hasta 64 caracteres) en un campo de texto en Designer Studio, tras haber establecido el contexto. Designer Studio es el área de trabajo para Pega Platform. La carga útil de XSS se ejecutará cuando otros desarrolladores visiten las páginas afectadas."
    }
  ],
  "lastModified": "2026-06-17T01:10:51.413",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pega:pega_platform:7.1.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5D9BC47-71D5-4B94-A080-CFAC9333B2FC"
            },
            {
              "criteria": "cpe:2.3:a:pega:pega_platform:7.1.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4E12061-0EE0-438C-8404-ECE0F47B0618"
            },
            {
              "criteria": "cpe:2.3:a:pega:pega_platform:7.1.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CFE81F3-D39E-4C6E-AFD3-079557547329"
            },
            {
              "criteria": "cpe:2.3:a:pega:pega_platform:7.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "919692B1-B283-4B23-A5D8-7319A11F319E"
            },
            {
              "criteria": "cpe:2.3:a:pega:pega_platform:7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED25574F-17E0-488D-998C-3840BD4BB742"
            },
            {
              "criteria": "cpe:2.3:a:pega:pega_platform:7.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D15022B1-12CE-446D-95D8-FF81D8974897"
            },
            {
              "criteria": "cpe:2.3:a:pega:pega_platform:7.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6229EED8-044C-4DB0-94BB-2451D54BE1C5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}