by Kastro
Paper/Archive/CVE-2021-27651

CVE-2021-27651

Pegasystems Pega Infinity — In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authent…

EPSS 54%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.0.990 × 2019.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.

Affected

ProductAffectedFixed inSource
Pega Infinity8.2.1 – < unspecifiedunspecifiedCNA
Pega Infinityunspecified – < 8.5.28.5.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pega (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

References

refcollaborate.pega.com/discussion/pega-security-advisory-a21-hotfix-matrix