Paper/Archive/CVE-2022-24082

CVE-2022-24082

Pegasystems Pega Infinity — If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port fil…

EPSS 12%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 96.2.962 × 2019.2 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.

Affected

ProductAffectedFixed inSource

Pega Infinity8.1.0 – < unspecifiedunspecifiedCNA

Pega Infinityunspecified – < 8.7.38.7.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pega (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsupport.pega.com/support-doc/pega-security-advisory-b22-vulnerability-%E2%80%93-hotfix-matrix-0 refpacketstormsecurity.com/files/169480/Pega-Platform-8.7.3-Remote-Code-Execution.html