Lucene search

PegaCVELIST:CVE-2021-27653

HistoryApr 01, 2021 - 6:38 p.m.

CVE-2021-27653

2021-04-0118:38:57

CWE-284

Pega

www.cve.org

pega chat

misconfiguration

data exposure

pega platform

CVSS3

6.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

34.2%

JSON

Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.

CNA Affected

[
  {
    "product": "Pega Infinity",
    "vendor": "Pega Systems",
    "versions": [
      {
        "status": "affected",
        "version": ">=7.4.0, <8.5.3"
      }
    ]
  }
]

References

collaborate.pega.com/discussion/pega-security-advisory-%E2%80%93-b21

robertwillishacking.com/census-vulnerability-exposes-10k-oauth-tokens-thousands-of-user-records/

CVSS3

6.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

34.2%

JSON

Related for CVELIST:CVE-2021-27653