CVE-2025-62181— Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-62181
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
Source: NVD (National Vulnerability Database)
Vulnerability Description
Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. This only applies to deprecated basic-authentication feature and other more secure authentication mechanisms are recommended. A fix is being provided in the 24.1.4, 24.2.4, and 25.1.1 patch releases. Please note: Basic credentials authentication service type is deprecated started in 24.2 version: https://docs.pega.com/bundle/platform/page/platform/release-notes/security/whats-new-security-242.html.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
响应差异性信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
Pega Platform 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Pega Platform是美国Pega公司的一个企业管理平台。 Pega Platform 7.1.0版本至Infinity 25.1.0版本存在安全漏洞，该漏洞源于用户认证过程中响应时间差异，可能导致用户枚举攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Pegasystems | Pega Infinity | 7.1.0 ~ Infinity 25.1.1 | - |
II. Public POCs for CVE-2025-62181
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-62181
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Pega Infinity
- CVE-2026-1711
Pega Platform versions 8.1.0 through 25.1.1 are affected by - CVE-2026-1564
Pega Platform versions 8.1.0 through 25.1.1 are affected by - CVE-2025-62184
Pega Platform versions 8.1.0 through 25.1.0 are affected by - CVE-2025-62183
Pega Platform versions 8.1.0 through 25.1.1 are affected by - CVE-2025-62182
Pega Customer Service Framework versions 8.7.0 through 25.1.
Same vendor: Pegasystems
- CVE-2026-1711
Pega Platform versions 8.1.0 through 25.1.1 are affected by - CVE-2026-1564
Pega Platform versions 8.1.0 through 25.1.1 are affected by - CVE-2026-1079
A native messaging host vulnerability in Pega Browser Extens - CVE-2026-1078
An arbitrary file-write vulnerability in Pega Browser Extens - CVE-2025-62184
Pega Platform versions 8.1.0 through 25.1.0 are affected by
Same weakness: CWE-204
- CVE-2026-8242
Industrial Application Software IAS Canias ERP Login RMI doA - CVE-2026-20195
Cisco Identity Services Engine Observable Response Discrepan - CVE-2026-24468
OpenAEV Vulnerable to Username/Email Enumeration Through Dif - CVE-2026-34264
Information Disclosure vulnerability in SAP Human Capital Ma - CVE-2026-4113
SonicWALL SMA1000 安全漏洞
V. Comments for CVE-2025-62181
No comments yet