Local Authentication Bypass in Pega Infinity by Pega Systems
CVE-2021-27651

9.8CRITICAL

Key Information:

Vendor

Pegasystems

Status
Pega Infinity
Vendor
CVE Published:
29 April 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 92%

What is CVE-2021-27651?

Versions 8.2.1 to 8.5.2 of Pega Infinity are susceptible to a vulnerability where the password reset functionality for local accounts may allow attackers to bypass local authentication checks, potentially granting unauthorized access to sensitive information.

Affected Version(s)

Pega Infinity 8.2.1

Pega Infinity < 8.5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-27651-PoC
Created by samwcyo

CVE-2021-27651
Created by orangmuda

CVE-2021-27651
Created by Vulnmachines

References

https://collaborate.pega.com/discussion/pega-security-adv...
x_refsource_CONFIRM

EPSS Score

92% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Samuel Curry (@samwcyo), Brett Buerhaus (@bbuerhaus), Maik Robert (@xEHLE_), Justin Rhinehart (@sshell_)
.