Pega Platform Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Pega Platform, affecting versions 8.1.0 through 25.1.1. This vulnerability resides within a user interface component and requires a high-privileged user with a developer role to exploit.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can update to Pega Platform versions 24.2.4 or 25.1.2. For on-premises or client-managed cloud clients, hotfixes are available for versions 23.1.5 and 24.1.4. Pega Cloud clients will have hotfixes applied proactively.