PEGA Platform 8.3.0 Audit Log !STANDARD?pyStream=MyAlerts Request information disclosure ⚔ [Disputed]
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.3 | $0-$5k | 0.00 |
A vulnerability was found in PEGA Platform 8.3.0 and classified as problematic. Affected by this issue is an unknown part of the file prweb/sso/random_token/!STANDARD?pyStream=MyAlerts of the component Audit Log. The manipulation as part of a Request leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:
PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account.
The weakness was presented 11/26/2019. This vulnerability is handled as CVE-2019-16388 since 09/17/2019. The exploitation is known to be easy. The attack may be launched remotely. A simple authentication is necessary for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.
The real existence of this vulnerability is still doubted at the moment.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
See VDB-146407 and VDB-146406 for similar entries.
Product
Name
Version
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.3VulDB Meta Temp Score: 4.3
VulDB Base Score: 4.3
VulDB Temp Score: 4.3
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 4.3
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Information disclosureCWE: CWE-200 / CWE-284 / CWE-266
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔍
Timeline
09/17/2019 🔍11/26/2019 🔍
11/27/2019 🔍
08/05/2024 🔍
Sources
Advisory: blog.cybercastrum.comStatus: Not defined
Disputed: 🔍
CVE: CVE-2019-16388 (🔍)
See also: 🔍
Entry
Created: 11/27/2019 08:44 AMUpdated: 08/05/2024 06:49 AM
Changes: 11/27/2019 08:44 AM (37), 11/27/2019 08:49 AM (17), 02/28/2024 12:46 PM (3), 06/27/2024 01:16 AM (15), 08/05/2024 06:49 AM (2)
Complete: 🔍
Cache ID: 18:28B:40
No comments yet. Languages: en.
Please log in to comment.