XSS Vulnerability in Pega Platform Affects Unauthenticated Users
CVE-2023-50166

6.1MEDIUM

Key Information:

Vendor: Pegasystems
Status: Pega Platform
Vendor: CVE Published:; 31 January 2024

🔔 Create Pegasystems Vulnerability Alert

What is CVE-2023-50166?

The Pega Platform versions ranging from 8.5.4 to 8.8.3 are susceptible to a Cross-Site Scripting (XSS) vulnerability that allows unauthenticated users to exploit a vulnerability via the redirect parameter. This could potentially allow attackers to inject malicious scripts into web pages viewed by other users, leading to unauthorized access to users' session information or manipulation of web sessions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Pega Platform 8.5.4 <= 8.8.3

References

https://support.pega.com/support-doc/pega-security-adviso...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Jan 31, 2024
Vulnerability Reserved
Dec 4, 2023

Credit

Tomasz Stachowicz

JSON

Pegasystems