{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-12-21T00:00:00", "descriptions": [{"lang": "en", "value": "An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-02-27T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-17478/pegasystems-security-bulletin-cve-2017-17478"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-17478", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-17478/pegasystems-security-bulletin-cve-2017-17478", "refsource": "CONFIRM", "url": "https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-17478/pegasystems-security-bulletin-cve-2017-17478"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-17478", "datePublished": "2018-02-27T15:00:00", "dateReserved": "2017-12-08T00:00:00", "dateUpdated": "2018-02-27T14:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pega:pega_platform:7.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "A5D9BC47-71D5-4B94-A080-CFAC9333B2FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:pega:pega_platform:7.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "B4E12061-0EE0-438C-8404-ECE0F47B0618", "vulnerable": true}, {"criteria": "cpe:2.3:a:pega:pega_platform:7.1.9:*:*:*:*:*:*:*", "matchCriteriaId": "7CFE81F3-D39E-4C6E-AFD3-079557547329", "vulnerable": true}, {"criteria": "cpe:2.3:a:pega:pega_platform:7.1.10:*:*:*:*:*:*:*", "matchCriteriaId": "919692B1-B283-4B23-A5D8-7319A11F319E", "vulnerable": true}, {"criteria": "cpe:2.3:a:pega:pega_platform:7.2:*:*:*:*:*:*:*", "matchCriteriaId": "ED25574F-17E0-488D-998C-3840BD4BB742", "vulnerable": true}, {"criteria": "cpe:2.3:a:pega:pega_platform:7.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "D15022B1-12CE-446D-95D8-FF81D8974897", "vulnerable": true}, {"criteria": "cpe:2.3:a:pega:pega_platform:7.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "6229EED8-044C-4DB0-94BB-2451D54BE1C5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages."}, {"lang": "es", "value": "Se ha descubierto un problema de XSS en Designer Studio en Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1 y 7.2.2. Un usuario con credenciales de desarrollador puede insertar c\u00f3digo malicioso (hasta 64 caracteres) en un campo de texto en Designer Studio, tras haber establecido el contexto. Designer Studio es el \u00e1rea de trabajo para Pega Platform. La carga \u00fatil de XSS se ejecutar\u00e1 cuando otros desarrolladores visiten las p\u00e1ginas afectadas."}], "id": "CVE-2017-17478", "lastModified": "2020-08-20T12:46:42.003", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-02-27T15:29:00.443", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-17478/pegasystems-security-bulletin-cve-2017-17478"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}