CVE-2020-23957

Name of the Vulnerable Software and Affected Versions Pega Platform versions prior to 8.5

Description The issue is related to Cross Site Scripting (XSS) and affects the Pega Platform. It occurs via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.

Recommendations For Pega Platform versions prior to 8.5, consider disabling the ConnectionID parameter or restricting access to the PRAuth URI until a patch is available. As a temporary workaround, avoid using the ConnectionID parameter in requests to the PRAuth URI.