CVE-2025-8681

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-8681", "assignerOrgId": "c91e5604-2bd1-401f-a0ec-b25342b57ef9", "state": "PUBLISHED", "assignerShortName": "Pega", "dateReserved": "2025-08-06T19:51:28.073Z", "datePublished": "2025-09-10T16:00:15.062Z", "dateUpdated": "2025-09-11T14:42:58.353Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Pega Infinity", "vendor": "Pegasystems", "versions": [{"lessThan": "Infinity 24.2.3", "status": "affected", "version": "7.1.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Louis Sohier of ENGIE IT Offensive Cybersecurity Team"}], "datePublic": "2025-09-10T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div>Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. &nbsp;Requires a high privileged user with a developer role.</div></div>"}], "value": "Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. \u00a0Requires a high privileged user with a developer role."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c91e5604-2bd1-401f-a0ec-b25342b57ef9", "shortName": "Pega", "dateUpdated": "2025-09-10T16:00:15.062Z"}, "references": [{"url": "https://support.pega.com/support-doc/pega-security-advisory-g25-vulnerability-remediation-note"}], "source": {"discovery": "UNKNOWN"}, "title": "Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:27:19.118508Z", "id": "CVE-2025-8681", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:42:58.353Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8681", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:27:19.118508Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:27:20.962Z"}}], "cna": {"title": "Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Louis Sohier of ENGIE IT Offensive Cybersecurity Team"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Pegasystems", "product": "Pega Infinity", "versions": [{"status": "affected", "version": "7.1.0", "lessThan": "Infinity 24.2.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2025-09-10T15:00:00.000Z", "references": [{"url": "https://support.pega.com/support-doc/pega-security-advisory-g25-vulnerability-remediation-note"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. \u00a0Requires a high privileged user with a developer role.", "supportingMedia": [{"type": "text/html", "value": "<div><div>Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. &nbsp;Requires a high privileged user with a developer role.</div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "c91e5604-2bd1-401f-a0ec-b25342b57ef9", "shortName": "Pega", "dateUpdated": "2025-09-10T16:00:15.062Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8681", "state": "PUBLISHED", "dateUpdated": "2025-09-11T14:42:58.353Z", "dateReserved": "2025-08-06T19:51:28.073Z", "assignerOrgId": "c91e5604-2bd1-401f-a0ec-b25342b57ef9", "datePublished": "2025-09-10T16:00:15.062Z", "assignerShortName": "Pega"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Pega Infinity", "vendor": "Pegasystems", "versions": [{"lessThan": "Infinity 24.2.3", "status": "affected", "version": "7.1.0", "versionType": "custom"}]}], "source": "security@pega.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pega:pega_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E025E37-EFCE-4BA5-8517-B34D445731B6", "versionEndExcluding": "23.1.5", "versionStartIncluding": "7.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:pega:pega_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "12DCD9B7-08F4-43D1-B361-2EC496D5F7C9", "versionEndExcluding": "24.1.3", "versionStartIncluding": "24.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:pega:pega_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "58EC0973-3139-4B4D-BE29-1911F0982C75", "versionEndExcluding": "24.2.2", "versionStartIncluding": "24.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. \u00a0Requires a high privileged user with a developer role."}, {"lang": "es", "value": "Las versiones de Pega Platform 7.1.0 hasta Infinity 24.2.2 est\u00e1n afectadas por un problema de XSS Almacenado en un componente de la interfaz de usuario. Requiere un usuario con altos privilegios y rol de desarrollador."}], "id": "CVE-2025-8681", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "security@pega.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8681", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T14:27:19.118508Z", "version": "2.0.3"}}]}, "published": "2025-09-10T16:15:42.130", "references": [{"source": "security@pega.com", "tags": ["Vendor Advisory"], "url": "https://support.pega.com/support-doc/pega-security-advisory-g25-vulnerability-remediation-note"}], "sourceIdentifier": "security@pega.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@pega.com", "type": "Secondary"}]}

{}

{"created": "2025-09-11T10:42:48.256498+00:00", "updated": "2025-09-11T10:42:48.256554+00:00", "vendors": ["pegasystems", "pegasystems$PRODUCT$pega_infinity"]}