Pega Infinity Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2020-23957 - Vulnerability Database

Pega Infinity Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2020-23957

Medium

Reference: CVE-2020-23957

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-23957

Title: Pega Infinity Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter as demonstrated by a pyActivityData-TRACERSettings.pzStartTracerSession request to a PRAuth URI.