CVE-2025-62184
LowCVSS 3.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. The attack requires administrative user privileges and extensive access rights, with low impact on confidentiality and no impact on integrity.
Risk Assessment
The organization is exposed to XSS attacks that could lead to theft of session data or other confidential information, but only by users with high privileges.
Recommendation
Update Pega Platform to version 25.1.1 or later, which includes a fix that prevents XSS.
Original NVD description (English source)
Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality is low and Integrity is none.