Pega Platform Vulnerabilities: Improper Control of Generation of Code
CVE-2024-10094

9.8CRITICAL

Key Information:

Vendor

Pegasystems

Status
Pega Infinity
Vendor
CVE Published:
20 November 2024

What is CVE-2024-10094?

The Pega Platform is impacted by a significant vulnerability that arises from improper control over the generation of code. This flaw can lead to exploitation scenarios where unauthorized code could potentially be executed, compromising the security of applications built on the platform. Affected versions range from legacy versions 6.x up to the latest Infinity release 24.1.1. Administrators are advised to review the security advisories available from Pega to mitigate potential risks.

Affected Version(s)

Pega Infinity 6.1 < 24.1.2

References

https://support.pega.com/support-doc/pega-security-adviso...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Wiseman from Commonwealth Bank of Australia
JSON
.
CVE-2024-10094 : Pega Platform Vulnerabilities: Improper Control of Generation of Code