PT-2017-11955 · Pegasystems · Pega Platform

Daniel Correa · Publicado 2017-08-02 · Atualizado 2017-09-08 · CVE-2017-11355

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PEGA Platform versions 7.2 ML0 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including the PATH INFO to the main page, the beanReference parameter to the JavaBean viewer page, or the pyTableName to the System database schema modification page.

Recommendations For PEGA Platform versions 7.2 ML0 and earlier, consider restricting access to the main page, JavaBean viewer page, and System database schema modification page until a fix is available. As a temporary workaround, avoid using the beanReference parameter and the pyTableName in their respective pages to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-11355

Produtos afetados

Pega Platform

Referências · 5

• 🔥 https://exploit-db.com/exploits/42335 · Exploit
• http://seclists.org/fulldisclosure/2017/Jul/28 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11355 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11355 · Aviso do Fabricante
• https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-11355-and-cve-2017-11356/pegasystems-security-bulletin-cve · Nota