CVE-2023-50166
MEDIUMCVSS 6.1/10EPSS 0.34%
Last modified
CVE-2023-50166 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pega | Platform | >= 8.5.4, <= 8.8.3 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-50166?
Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
How severe is CVE-2023-50166?
CVE-2023-50166 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.34% probability of exploitation in the next 30 days.
How do I fix CVE-2023-50166?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-5015A vulnerability was found in UCMS 1.4.7. It has been classif…6.1
- CVE-2023-50159In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mod…8.8
- CVE-2023-5016A vulnerability was found in spider-flow up to 0.5.0. It has…9.8
- CVE-2023-50162SQL injection vulnerability in EmpireCMS v7.5, allows remote…7.2
- CVE-2023-50164An attacker can manipulate file upload params to enable path…9.8
- CVE-2023-50165Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected…8.6
- CVE-2023-50167Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS iss…6.1
- CVE-2023-50168Pega Platform from 6.x to 8.8.4 is affected by an XXE issue …7.7
- CVE-2023-5017A vulnerability was found in lmxcms up to 1.41. It has been …9.8
- CVE-2023-50170Rejected reason: This is unused.
- CVE-2023-50172A recovery notification bypass vulnerability exists in the u…5.3
- CVE-2023-50174Rejected reason: This is unused.
Are you affected by CVE-2023-50166?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST