CVE-2021-27651

요약 공격자는 비밀번호 재설정 흐름의 모든 단계를 우회하고 Pega Infinity에서 임의 사용자의 계정을 재설정할 수 있습니다. 이는 1 비밀번호 재설정 흐름을 시작하고 피해자의 이메일을 입력한 다음, 2 HTTP POST 요청이 통과하도록 강제하여 비밀번호를 업데이트하는 방식으로 이루어집니다. 공격자는 새로 변경된 계정으로 로그인한 후, 허용되는 다양한 인증 후 코드 실행 벡터동적 페이지 수정, 템플릿 등를 통해 Pega 인스턴스를 완전히 장악할 수 있습니다. 재현 단계 1. 아무 Pega 인스턴스의 로그인 페이지로...

CVE-2021-27651

CVE-2021-27651 Pega Infinity 비밀번호 재설정 동영상 팔로우 유튜브 트위터 텔레그램 Vulnmachines.com...

📄 PEGA Infinity Brute Force / Insecure Direct Object Reference

PEGA Infinity suffers from brute forcing and insecure direct object reference vulnerabilities. Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by the brute force issue. Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by the idor issue. SEC Consult Vulnerability Lab...

CVE-2021-27651

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks...

Pega Infinity patches authentication vulnerability

Security researchers came across a Pega Infinity vulnerability through participation in Apple’s bug bounty program, after focusing on vendors that supplied technology to Apple. By using Burp Suite—an integrated platform for performing security testing of web applications—the security researchers...

Pega Infinity登陆绕过漏洞（CVE-2021-27651）

Summary An attacker can bypass all stages of the password reset flow and reset any user's account on Pega infinity. This is done by 1 initiating the password reset flow and typing in the victim email, then 2 forcing the HTTP POST request to update the password through. An attacker could login usi...

CVE-2021-27651

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks...

CVE-2021-27651

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks...

Authentication flaw

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks...

CVE-2021-27651

CVE-2021-27651 affects Pega Infinity versions 8.2.1 through 8.5.2. The password-reset flow for local accounts can bypass local authentication checks, enabling an attacker to gain unauthorized access to a Pega Infinity installation. Public sources describe a path to login with an administrator acc...

CVE-2021-27651

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks...

PEGA pega infinity 授权问题漏洞

PEGA pega infinity is an application from PEGA USA. Provides transition from digital chaos to true digital conversion. An authorization issue vulnerability exists in Pega Infinity versions 8.2.1 through 8.5.2, which stems from the fact that the password reset feature for local accounts can be use...

PT-2021-17582 · Pegasystems · Pega Infinity

Name of the Vulnerable Software and Affected Versions: Pega Infinity versions 8.2.1 through 8.5.2 Description: The issue concerns the password reset functionality for local accounts, which can be exploited to bypass local authentication checks. Recommendations: For Pega Infinity versions 8.2.1...