CVE Vulnerability

CVE-2022-24082

If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://support.pega.com/support-doc/pega-security-advisory-b22-vulnerability-%E2%80%93-hotfix-matrix-0 Vendor Advisory
http://packetstormsecurity.com/files/169480/Pega-Platform-8.7.3-Remote-Code-Execution.html Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:pega:infinity:*:*:*:*:*:*:*:*
Information

Published : 2022-07-19 03:15

Updated : 2022-11-07 05:44

NVD link : CVE-2022-24082

Mitre link : CVE-2022-24082

Products Affected
No products.
CWE
CWE-502

Deserialization of Untrusted Data