CVE-2022-24082: critical vulnerability in Pegasystems Pega Infinity
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
53Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 12%
from disclosure to weapon252 days
Published on NVDJul 19
1st PoC+252d
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Pegasystems · Pega Infinitypublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/51099unverifiedcve_referencepacketstormsecurity.com/files/169480/Pega-Platform-8.7.3-Remote-Code-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Pegasystems Pega Infinity
In the same product, most dangerous first.
CVE-2021-27651CRITICALCVE-2021-27651EPSS 53.8%CVE-2022-24083CRITICALCVE-2022-24083EPSS 0.9%CVE-2026-10754HIGHPega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.EPSS 0.8%CVE-2021-27654HIGHCVE-2021-27654EPSS 0.6%CVE-2022-35654MEDIUMCVE-2022-35654EPSS 0.5%CVE-2022-35655MEDIUMCVE-2022-35655EPSS 0.5%