PT-2022-9840 · Pegasystems+1 · Pega Infinity+1

Published 2022-01-28 · Updated 2022-02-03 · CVE-2021-27654

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned.

Description The issue concerns the forgotten password reset functionality for local accounts, which can be exploited to bypass local authentication checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2021-27654

Affected Products

Pega Infinity

Infinity

References · 3

• https://osv.dev/vulnerability/CVE-2021-27654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27654 · Security Note
• https://collaborate.pega.com/discussion/pega-security-advisory-c21 · Vendor Advisory