XSS Vulnerability in Pega Platform Affects Unauthenticated Users
CVE-2023-50166

6.1MEDIUM

Key Information:

Vendor: Pegasystems
Status: Pega Platform
Vendor: CVE Published:; 31 January 2024

🔔 Create Pegasystems Vulnerability Alert

What is CVE-2023-50166?

The Pega Platform versions ranging from 8.5.4 to 8.8.3 are susceptible to a Cross-Site Scripting (XSS) vulnerability that allows unauthenticated users to exploit a vulnerability via the redirect parameter. This could potentially allow attackers to inject malicious scripts into web pages viewed by other users, leading to unauthorized access to users' session information or manipulation of web sessions.

Affected Version(s)

Pega Platform 8.5.4 <= 8.8.3

References

https://support.pega.com/support-doc/pega-security-adviso...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 31, 2024
Vulnerability Reserved
Dec 4, 2023

Credit

Tomasz Stachowicz

CVE-2023-50166 Data

JSON