CVE-2021-27651

🗓️ 29 Apr 2021 14:47:20Reported by PegaType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 98 Views🌐 WEB

In Pega Infinity 8.2.1-8.5.2, password reset bypasses local authentication checks

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2021-27651	17 May 202111:36	–	circl
CNNVD	PEGA pega infinity 授权问题漏洞	29 Apr 202100:00	–	cnnvd
Cvelist	CVE-2021-27651	29 Apr 202114:47	–	cvelist
Malwarebytes	Pega Infinity patches authentication vulnerability	19 May 202114:53	–	malwarebytes
Nuclei	Pega Infinity - Authentication Bypass	6 Jun 202603:01	–	nuclei
NVD	CVE-2021-27651	29 Apr 202115:15	–	nvd
Prion	Authentication flaw	29 Apr 202115:15	–	prion
Positive Technologies	PT-2021-17582 · Pegasystems · Pega Infinity	29 Apr 202100:00	–	ptsecurity
RedhatCVE	CVE-2021-27651	9 Jan 202608:53	–	redhatcve
seebug.org	Pega Infinity登陆绕过漏洞（CVE-2021-27651）	17 May 202100:00	–	seebug

NVD

Node

pega infinityRange8.2.1–8.5.2

[
  {
    "product": "Pega Infinity",
    "vendor": "Pegasystems",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.2.1",
        "versionType": "custom"
      },
      {
        "lessThan": "8.5.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
collaborate	www.collaborate.pega.com/discussion/pega-security-advisory-a21-hotfix-matrix

Parameter	Position	Path	Description	CWE
pzAuth	request body	prweb/PRServlet/app/default/:PEGA_ID*/!STANDARD	Bypass password reset protection by modifying the reset request to set a new password and gain access.	CWE-287
NewPassword	request body	prweb/PRServlet/app/default/:PEGA_ID*/!STANDARD	Bypass password reset protection by modifying the reset request to set a new password and gain access.	CWE-287
ConfPassword	request body	prweb/PRServlet/app/default/:PEGA_ID*/!STANDARD	Bypass password reset protection by modifying the reset request to set a new password and gain access.	CWE-287

21 Nov 2024 05:58Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 3.19.8

CVSS 39.8

EPSS0.91002

CWE-287