Pega continually works to implement security controls designed to protect client environments. With this focus, Pega has issued patch releases/hotfixes for two high security vulnerabilities in Pega Platform. We would like to thank Kacper Paluch and Maciej Włodarczyk from STM Cyber for finding these vulnerabilities.
|
Advisory |
Description |
Impact |
Remediation |
|---|---|---|---|
|
D25 |
2 - Cross Site Script (XSS) vulnerabilities |
Cross-site scripting (XSS) is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. Attackers often initiate an XSS attack by sending a malicious link to a user and enticing the user to click it.
|
For both issues: 8.8.5 hotfix 23.1.5 Patch Release 24.1.2 hotfix 24.1.3 Patch Release 24.2.1 hotfix 24.2.2 Patch Release 25.1.0 Release |
We are not aware of any of our clients being compromised as a result of these vulnerabilities.
The remediation for these issues will be included as part of the product in the Pega Platform patch releases listed above. Hotfixes for 8.8.5, 23.1.4, 24.1.2, 24.2.1 are available as described below.
If you are a Pega Cloud® client, your Pega Cloud environments running the relevant Pega versions listed in the table below, are being proactively remediated by Pega. Cloud Maintenance (CM) cases are being created for each of your environments and will provide the schedule of when the hotfixes will be applied. If you are not on a version with a solution provided, you need to upgrade as soon as possible.
If you are a United States Pega Cloud for Government (PCFG) client, Cloud Change (CC) cases are being created for the relevant hotfix, which will be applied by Pega. If you are not on a version with a solution provided, you need to upgrade as soon as possible.
If you are an on–premises or client managed cloud client, please review the tables below to determine which hotfixes correspond to your Pegasystems installation. Once you have determined the appropriate hotfix IDs, you can download your hotfix directly from My Security Hotfixes on My Pega
Information regarding the availability of the hotfixes will be publicly posted on Pega Support Center on April 14, 2025. We request that clients not discuss this in public forums until after it’s been publicly posted.
As always, we recommend our clients review our Security Checklist regularly.
Hotfixes
Hotfixes are being created only for the latest patch releases in standard support (8.8.5, 23.1.4, 24.1.2 & 24.2.1). We will not provide hotfixes on prior versions of the platform.
As a best practice, you should update your Pega environment to the latest release to take advantage of the latest features, capabilities, security and bug fixes. See Keeping current with Pega.
|
Version |
Both XSS issues |
|---|---|
|
8.8.5 |
HFIX-C644 |
|
23.1.4 |
HFIX-C642 |
|
24.1.2 |
HFIX-C643 |
|
24.2.1 |
HFIX-C604 |
No restart is needed after installing the hotfix.
Dates for upcoming patch releases can be found here: Pega Infinity Patch Calendar
CVE Details
|
CVE Details |
XSS issue with Mashup |
XSS issue with Mashup |
|---|---|---|
|
Software/Product |
Pega Platform |
Pega Platform |
|
Affected Version(s) |
From 8.4.3 to 24.2.1 |
From 7.2.1 to 24.2.1 |
|
CVE ID |
CVE-2025-2160 |
CVE-2025-2161 |
|
CVSS Rating |
High – 8.1 |
High – 7.1 |
|
Description |
Cross Site Script (XSS) vulnerability |
Cross Site Script (XSS) vulnerability |
If you have any questions or concerns, please raise a Support ticket with Global Client Support in My Support Portal for assistance.