CVE-2017-11355 : What You Need to Know
Learn about CVE-2017-11355, a vulnerability in PEGA Platform 7.2 ML0 allowing remote attackers to inject malicious scripts. Find mitigation steps and long-term security practices here.
Remote attackers can inject arbitrary web script or HTML into PEGA Platform 7.2 ML0 and earlier versions through multiple cross-site scripting (XSS) vulnerabilities.
Understanding CVE-2017-11355
This CVE involves the exploitation of XSS vulnerabilities in PEGA Platform 7.2 ML0 and earlier versions.
What is CVE-2017-11355?
CVE-2017-11355 allows remote attackers to inject malicious web script or HTML by manipulating specific parameters within the PEGA Platform.
The Impact of CVE-2017-11355
- Remote attackers can execute arbitrary web script or HTML on affected systems.
- This can lead to unauthorized access, data theft, and potential system compromise.
Technical Details of CVE-2017-11355
This section provides detailed technical information about the vulnerability.
Vulnerability Description
Multiple XSS vulnerabilities in PEGA Platform 7.2 ML0 and earlier versions enable attackers to inject malicious scripts or HTML code through:
- PATH_INFO on the main page
- beanReference parameter on the JavaBean viewer page
- pyTableName on the System database schema modification page
Affected Systems and Versions
- Product: PEGA Platform
- Versions affected: 7.2 ML0 and earlier
Exploitation Mechanism
Attackers exploit the XSS vulnerabilities by manipulating specific parameters within the PEGA Platform, allowing them to inject malicious scripts or HTML.
Mitigation and Prevention
Protecting systems from CVE-2017-11355 requires immediate actions and long-term security practices.
Immediate Steps to Take
- Apply security patches provided by the vendor.
- Implement input validation to sanitize user inputs.
- Monitor and filter user-supplied data to prevent XSS attacks.
Long-Term Security Practices
- Regularly update and patch software to address security vulnerabilities.
- Conduct security assessments and penetration testing to identify and remediate weaknesses.
Patching and Updates
- Stay informed about security bulletins and updates from PEGA Platform.
- Apply patches promptly to mitigate the risk of XSS attacks.