Pega Platform Cross-Site Scripting Vulnerability in Mashup

A cross-site scripting (XSS) vulnerability has been identified in Pega Platform, affecting versions 7.2.1 prior to 24.2.1. This issue allows attackers to inject malicious scripts into trusted applications, potentially leading to execution of those scripts in the context of the user.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts can be executed in the user's browser, potentially leading to session hijacking or other malicious actions.

Remediation

Users can upgrade to Pega Platform versions 8.8.5, 23.1.4, 24.1.2, 24.2.1, or 25.1.0. For Pega Cloud clients, these hotfixes are being applied automatically. On-premises clients can download the hotfixes from 'My Pega'.