PT-2020-15605
CVE-2020-23957
·
تاريخ النشر
2020-12-15
·
تاريخ التحديث
2020-12-17
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Pega Platform versions prior to 8.5
Description
The issue is related to Cross Site Scripting (XSS) and affects the Pega Platform. It occurs via the
ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.Recommendations
For Pega Platform versions prior to 8.5, consider disabling the
ConnectionID parameter or restricting access to the PRAuth URI until a patch is available. As a temporary workaround, avoid using the ConnectionID parameter in requests to the PRAuth URI. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾