2 lines
3.4 KiB
JSON
2 lines
3.4 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pega Robot Studio","vendor":"Pegasystems","versions":[{"status":"affected","version":"22.1"},{"status":"affected","version":"R25"}]}],"source":"security@pega.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A bad actor could create a website that includes malicious code. The vulnerability may be exploited if a Pega Robot Studio developer is deceived into visiting this website during interrogation mode in Robot Studio."},{"lang":"es","value":"Una vulnerabilidad de escritura de archivos arbitraria en la extensión de navegador Pega (PBE) afecta a los desarrolladores de Pega Robot Studio que están automatizando Google Chrome y Microsoft Edge utilizando la versión 22.1 o R25. Esta vulnerabilidad no afecta a los usuarios de Robot Runtime. Un actor malicioso podría crear un sitio web que incluya código malicioso. La vulnerabilidad podría ser explotada si un desarrollador de Pega Robot Studio es engañado para visitar este sitio web durante el modo de interrogación en Robot Studio."}],"id":"CVE-2026-0898","lastModified":"2026-06-17T10:11:35.347","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@pega.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0898","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-24T14:37:24.108479Z","version":"2.0.3"}}]},"published":"2026-03-23T19:16:39.040","references":[{"source":"security@pega.com","url":"https://support.pega.com/support-doc/pega-security-advisory-p25-vulnerability-remediation-note"}],"sourceIdentifier":"security@pega.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@pega.com","type":"Secondary"}]}
|