PT-2020-9823 · Pegasystems · Pega Platform

Iag0110 · Published 2020-08-13 · Updated 2020-08-19 · CVE-2019-16374

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pega Platform version 8.2.1

Description The issue allows LDAP injection because a username can contain a * character and can be of unlimited length. An attacker can specify four characters of a username, followed by the * character, to bypass access control.

Recommendations For Pega Platform version 8.2.1, consider restricting the length and special characters allowed in usernames to prevent LDAP injection attacks. As a temporary workaround, restrict access to LDAP authentication to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2019-16374

Affected Products

Pega Platform

References · 5

• https://osv.dev/vulnerability/CVE-2019-16374 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16374 · Security Note
• https://community.pega.com/upgrade · Vendor Advisory
• https://t.me/cibsecurity/14110 · Telegram Post
• https://gist.github.com/IAG0110/0205823570ba04ec12e656f7f4602877 · Note