CVE-2020-23957: Pega Platform

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.

Affected products

• Pega Pega Platform: from 8.4, up to and including 8.4.2

Published 2020-12-15. Last modified 2026-06-17.