Pega Platform is affected by Cross Site Scripting (XSS) via the ConnectionID parameter : CVE-2020-23957

General
, ,
1

Security team identified Vulnerability CVE-2020-23957 in Pega 7.3.1 and i could see this is specified in Pega security bulletin as well.

Pega Platform is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23957

Is there a fix available for this vulnerability in Pega 7.3.1?

2

@KiranKS yes in the support ticket that you have already logged please request HFIX-68904.

Alternatively log a new ‘Request HFIX’ ticket and let the team know.