CVE-2021-27651

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Apr 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-276534.9Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.CVE-2021-276547.8Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.CVE-2021-276567.5A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information abou CVE-2021-276578.8Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file syst CVE-2021-276585.4exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is plac CVE-2021-276596.1exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in o CVE-2021-276608.8An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs.CVE-2021-276618.8Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user CVE-2021-276628.1The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This iss CVE-2021-276639.8A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system withou CVE-2021-276649.8Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.CVE-2021-276657.5An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted scrip