CVE-2019-16388

Name of the Vulnerable Software and Affected Versions PEGA Platform version 8.3.0

Description The issue allows information disclosure via a direct request to "prweb/sso/random token/!STANDARD?pyStream=MyAlerts" to get Audit Log information. The vendor states that this functionality was discovered using an administrator account and is considered normal administrator functionality, contradicting the claim that it was done with a low-privilege account.

Recommendations For PEGA Platform version 8.3.0, consider restricting access to the "prweb/sso/random token/!STANDARD?pyStream=MyAlerts" endpoint to minimize the risk of information disclosure. At the moment, there is no information about a newer version that contains a fix for this issue.