CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24083
https://notcve.org/view.php?id=CVE-2022-24083
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Una vulnerabilidad de omisión de autenticación de contraseñas para cuentas locales puede ser usada para omitir las comprobaciones de autenticación local • https://support.pega.com/support-doc/pega-security-advisory-c22-vulnerability-%E2%80%93-hotfix-matrix-0 • CWE-285: Improper Authorization •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2022-24082 – Pega Platform 8.1.0 - Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2022-24082
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture. Si una instalación local de Pega Platform está configurada con el puerto de la interfaz JMX expuesto a Internet y el filtrado de puertos no está configurado apropiadamente, puede ser posible cargar cargas útiles serializadas para atacar el sistema subyacente. Esto no afecta a sistemas que son ejecutados en PegaCloud debido a su diseño y arquitectura. Pega Platform versions 8.1.0 through 8.7.3 suffer from a remote code execution vulnerability. • https://www.exploit-db.com/exploits/51099 http://packetstormsecurity.com/files/169480/Pega-Platform-8.7.3-Remote-Code-Execution.html https://support.pega.com/support-doc/pega-security-advisory-b22-vulnerability-%E2%80%93-hotfix-matrix-0 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27654
https://notcve.org/view.php?id=CVE-2021-27654
Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. La funcionalidad Forgotten password reset para cuentas locales puede ser usada para omitir las comprobaciones de autenticación local • https://collaborate.pega.com/discussion/pega-security-advisory-c21 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 9.8EPSS: 6%CPEs: 1EXPL: 3CVE-2021-27651
https://notcve.org/view.php?id=CVE-2021-27651
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. En versiones 8.2.1 hasta 8.5.2 de Pega Infinity, la funcionalidad password reset para cuentas locales puede ser usada para omitir las comprobaciones de autenticación locales • https://github.com/samwcyo/CVE-2021-27651-PoC https://github.com/Vulnmachines/CVE-2021-27651 https://github.com/orangmuda/CVE-2021-27651 https://collaborate.pega.com/discussion/pega-security-advisory-a21-hotfix-matrix • CWE-287: Improper Authentication •
CVSS: 6.6EPSS: 0%CPEs: 1EXPL: 1CVE-2021-27653
https://notcve.org/view.php?id=CVE-2021-27653
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure. La configuración incorrecta del portal Pega Chat Access Group en la plataforma Pega versiones 7.4.0 - 8.5.x podría conllevar a una exposición de datos no intencionada. • https://collaborate.pega.com/discussion/pega-security-advisory-%E2%80%93-b21 https://robertwillishacking.com/census-vulnerability-exposes-10k-oauth-tokens-thousands-of-user-records • CWE-284: Improper Access Control •