Description

Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.

Remediation

References

CVE-2020-23957

Related Vulnerabilities

Python Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-9948)

Tornado Improper Input Validation Vulnerability (CVE-2012-2374)

WordPress Plugin WordPress Gallery-NextGEN Gallery Cross-Site Request Forgery (3.28)

IBM RTC Improper Restriction of XML External Entity Reference Vulnerability (CVE-2016-0219)

PHP Insufficient Verification of Data Authenticity Vulnerability (CVE-2024-5458)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2020-23957