VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Nov 26, 2019· Updated Jun 17, 2026

CVE-2019-16386

CVE-2019-16386

Description

PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect

Affected products

3
  • Pega/Pega Platform2 versions
    cpe:2.3:a:pega:pega_platform:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:pega:pega_platform:*:*:*:*:*:*:*:*range: >=7.1.0,<=7.4.0
    • (no CPE)range: 7.x and 8.x
  • PEGA/PEGA Platformdescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.