PT-2017-11955 · Pegasystems · Pega Platform

Daniel Correa · Published 2017-08-02 · Updated 2017-09-08 · CVE-2017-11355

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PEGA Platform versions 7.2 ML0 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including the PATH INFO to the main page, the beanReference parameter to the JavaBean viewer page, or the pyTableName to the System database schema modification page.

Recommendations For PEGA Platform versions 7.2 ML0 and earlier, consider restricting access to the main page, JavaBean viewer page, and System database schema modification page until a fix is available. As a temporary workaround, avoid using the beanReference parameter and the pyTableName in their respective pages to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-11355

Affected Products

Pega Platform

References · 5

• 🔥 https://exploit-db.com/exploits/42335 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-11355 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11355 · Vendor Advisory
• http://seclists.org/fulldisclosure/2017/Jul/28 · Note
• https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-11355-and-cve-2017-11356/pegasystems-security-bulletin-cve · Note