Pega Infinity patches authentication vulnerability

Security researchers came across a Pega Infinity vulnerability through participation in Apple’s bug bounty program, after focusing on vendors that supplied technology to Apple. By using Burp Suite—an integrated platform for performing security testing of web applications—the security researchers...

CVE-2021-27651

creationtimestamp| type| source ---|---|--- 2021-05-17 11:36:19+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/3384 2021-05-17 17:34:30+00:00| published-proof-of-concept| https://t.me/cKure/5401 2021-05-18 10:31:48+00:00| published-proof-of-concept|...

Pega Infinity登陆绕过漏洞（CVE-2021-27651）

Summary An attacker can bypass all stages of the password reset flow and reset any user's account on Pega infinity. This is done by 1 initiating the password reset flow and typing in the victim email, then 2 forcing the HTTP POST request to update the password through. An attacker could login usi...

CVE-2021-27651

CVE-2021-27651 affects Pega Infinity versions 8.2.1 through 8.5.2. The password-reset flow for local accounts can bypass local authentication checks, enabling an attacker to gain unauthorized access to a Pega Infinity installation. Public sources describe a path to login with an administrator acc...