Skip to main content

Resolved Issues

View the resolved issues for a specific Platform release.

Go to download resolved issues by patch release.

Browse release notes for a selected Pega Version.

NOTE: Enter just the Case ID number (SR or INC) in order to find the associated Support Request.

Please update your bookmarks. This site will be discontinued in Dec 2024.

Pega Platform Resolved Issues for 8.1 and newer are now available on the Support Center.

SR-A90144 · Issue 259472

Apache Struts JARS updated to improve security

Resolved in Pega Version 7.2.2

The Apache Struts JARs have been updated to resolve the following potential security vulnerabilities: The REST plugin in Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression. Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors. The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

SR-A93015 · Issue 260000

Apache Struts JARS updated to improve security

Resolved in Pega Version 7.2.2

The Apache Struts JARs have been updated to resolve the following potential security vulnerabilities: The REST plugin in Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression. Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors. The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

SR-A93024 · Issue 259995

Apache Struts JARS updated to improve security

Resolved in Pega Version 7.2.2

The Apache Struts JARs have been updated to resolve the following potential security vulnerabilities: The REST plugin in Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression. Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors. The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

SR-A23603 · Issue 258204

ADP alert messages updated for security

Resolved in Pega Version 7.2.2

To improve security, ADP alert messages have been changed to include only data page name rather than the cache key used to identify the data page in the async service manager cache.

SR-A91743 · Issue 258673

Security update for pxInitials control

Resolved in Pega Version 7.2.2

XSS (Cross Scripting Filter) has been added for potentially exploitable parameters in the pxInitials control.

SR-A102969 · Issue 273954

XSS security update for error.jsp

Resolved in Pega Version 7.3

The error.jsp file has been updated for better XSS security with WebSphere and Firefox.

SR-A96514 · Issue 275326

Updated encryption logic for URL obfuscation

Resolved in Pega Version 7.3

If URL obfuscation was enabled and the incoming URL had non-ASCII characters (or UNICODE) characters in it, the encryption process was failing due to the incorrect length of byte array formation in padding logic. This logic error has been corrected.

SR-A97323 · Issue 266550

XSS filtering added to pzDisplayModalDialog

Resolved in Pega Version 7.3

XSS filtering has been added to the pzDisplayModalDialog to improve security.

SR-B10697 · Issue 282917

XSS handling added for pyCategory in Rule-Obj-Listview.ListViewHeader

Resolved in Pega Version 7.3

Cross-site scripting handling has been added for the pyCategory parameter in ListViewHeader to improve security.

SR-B10697 · Issue 280753

XSS handling added for pyCategory in Rule-Obj-Listview.ListViewHeader

Resolved in Pega Version 7.3

Cross-site scripting handling has been added for the pyCategory parameter in ListViewHeader to improve security.

We'd prefer it if you saw us at our best.

Pega.com is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us