PT-2020-15605 · Pegasystems · Pega Platform

Published 2020-12-15 · Updated 2020-12-17 · CVE-2020-23957

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pega Platform versions prior to 8.5

Description The issue is related to Cross Site Scripting (XSS) and affects the Pega Platform. It occurs via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.

Recommendations For Pega Platform versions prior to 8.5, consider disabling the ConnectionID parameter or restricting access to the PRAuth URI until a patch is available. As a temporary workaround, avoid using the ConnectionID parameter in requests to the PRAuth URI.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-23957

Affected Products

Pega Platform

References · 5

• 🔥 https://jayaramyalla.medium.com/cross-site-scripting-in-pega-cve-2020-23957-16d1c417da5f · Exploit
• https://osv.dev/vulnerability/CVE-2020-23957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23957 · Security Note
• https://t.me/cibsecurity/20885 · Telegram Post
• https://t.me/cvenotify/7235 · Telegram Post