Critical · published April 29, 2021
CVSS calls it critical at 9.8. It sits in the 99.0th percentile for exploit probability.
🚨 A password reset can pull a fast one! In Pega Infinity versions 8.2.1 to 8.5.2, you can bypass local authentication checks with a well-timed reset! 🔥 Think of it as a hotel allowing guests to enter any room just by asking for a key, without checking if they’ve actually booked it — a recipe for disaster! An attacker could waltz right in and access any local account by exploiting this weakness — reading sensitive data, altering permissions, or even locking out legitimate users. It’s absolutely devastating for security!
Think of it as a hotel allowing guests to enter any room just by asking for a key, without checking if they’ve actually booked it — a recipe for disaster! This vulnerability allows unauthorized users to reset passwords for local accounts without proper authentication, making it trivial to gain access to the system.
An attacker could waltz right in and access any local account by exploiting this weakness — reading sensitive data, altering permissions, or even locking out legitimate users. It’s absolutely devastating for security! Patch to version 8.5.3 or later immediately. Additionally, review your password reset processes to ensure proper verification steps are in place before granting access. Don't wait on this! You've got this! With these steps, you'll reinforce your security and keep the bad guys out! 🛡️