CVE-2022-24082
Pega Platform 8.1.0 - Remote Code Execution (RCE)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.
Si una instalación local de Pega Platform está configurada con el puerto de la interfaz JMX expuesto a Internet y el filtrado de puertos no está configurado apropiadamente, puede ser posible cargar cargas útiles serializadas para atacar el sistema subyacente. Esto no afecta a sistemas que son ejecutados en PegaCloud debido a su diseño y arquitectura.
Pega Platform versions 8.1.0 through 8.7.3 suffer from a remote code execution vulnerability. If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-27 CVE Reserved
- 2022-07-19 CVE Published
- 2023-03-28 First Exploit
- 2024-08-03 CVE Updated
- 2024-10-10 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (3)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://www.exploit-db.com/exploits/51099 | 2023-03-28 | |
http://packetstormsecurity.com/files/169480/Pega-Platform-8.7.3-Remote-Code-Execution.html | 2024-08-03 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Pega Search vendor "Pega" | Infinity Search vendor "Pega" for product "Infinity" | >= 8.1.0 < 8.7.3 Search vendor "Pega" for product "Infinity" and version " >= 8.1.0 < 8.7.3" | - |
Affected
|