CVE-2019-16386

PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect

• CWE-425

• https://blog.cybercastrum.com/2019/11/25/cve-2019-16386/Exploit, Third Party Advisory
• https://blog.cybercastrum.com/2019/11/25/cve-2019-16386/Exploit, Third Party Advisory

Published

Nov 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16378OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is pro…9.8
• CVE-2019-1638A vulnerability in the Cisco Webex Network Recording Player …7.8
• CVE-2019-16382An issue was discovered in Ivanti Workspace Control 10.3.110…9.8
• CVE-2019-16383MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 b…9.4
• CVE-2019-16384Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path travers…6.5
• CVE-2019-16385Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response sp…6.1
• CVE-2019-16387PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/rand…8.1
• CVE-2019-16388PEGA Platform 8.3.0 is vulnerable to Information disclosure …4.3
• CVE-2019-1639A vulnerability in the Cisco Webex Network Recording Player …7.8
• CVE-2019-16391SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated…6.5
• CVE-2019-16392SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formula…6.1
• CVE-2019-16393SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect …6.1