medium6.5Public exploit code
CVE-2017-11356
The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sens…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PEGA Platform <= 7.2 ML0 - Missing Access Control / Cross-Site Scripting2017-07-18 · webapps · multiple
Impact
The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration information by leveraging a missing access control.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pega | Pega Platform | through 7.2_ml0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2017/Jul/28
- https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-11355-and-cve-2017-11356/pegasystems-security-bulletin-cve
- https://www.exploit-db.com/exploits/42335/
- http://seclists.org/fulldisclosure/2017/Jul/28
- https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-11355-and-cve-2017-11356/pegasystems-security-bulletin-cve
- https://www.exploit-db.com/exploits/42335/