Description
PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect
Remediation
References
Related Vulnerabilities
MySQL CVE-2019-2822 Vulnerability (CVE-2019-2822)
Moodle Credentials Management Errors Vulnerability (CVE-2014-0008)
WordPress Plugin RSVPMaker for Toastmasters Cross-Site Request Forgery (3.3.4)
WordPress Plugin Hustle-Pop-Ups, Slide-ins and Email Opt-ins CSV Injection (6.0.7)
Envoy Proxy NULL Pointer Dereference Vulnerability (CVE-2026-47220)