PT-2017-11956 · Pegasystems · Pega Platform

Daniel Correa · Publicado 2017-08-02 · Atualizado 2017-09-08 · CVE-2017-11356

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PEGA Platform versions 7.2 ML0 and earlier

Description The issue concerns a missing access control in the application distribution export functionality, allowing remote authenticated users with certain privileges to obtain sensitive configuration information.

Recommendations For PEGA Platform versions 7.2 ML0 and earlier, consider restricting access to the application distribution export functionality to minimize the risk of exploitation until a fix is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-11356

Produtos afetados

Pega Platform

Referências · 5

• 🔥 https://exploit-db.com/exploits/42335 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-11356 · Nota de Segurança
• http://seclists.org/fulldisclosure/2017/Jul/28 · Nota
• https://osv.dev/vulnerability/CVE-2017-11356 · Aviso do Fabricante
• https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-11355-and-cve-2017-11356/pegasystems-security-bulletin-cve · Nota