Vulnerability Description
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pega | Infinity | >= 8.2.1, <= 8.5.2 |
Related Weaknesses (CWE)
References
- https://collaborate.pega.com/discussion/pega-security-advisory-a21-hotfix-matrixRelease NotesVendor Advisory
- https://collaborate.pega.com/discussion/pega-security-advisory-a21-hotfix-matrixRelease NotesVendor Advisory
FAQ
What is CVE-2021-27651?
CVE-2021-27651 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
How severe is CVE-2021-27651?
CVE-2021-27651 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-27651?
Check the references section above for vendor advisories and patch information. Affected products include: Pega Infinity.