CVE-2021-27651: 
NixOS vulnerability analysis and mitigation

CVE-2021-27651 affects Pega Infinity versions 8.2.1 through 8.5.2, where a vulnerability in the password reset functionality for local accounts could be exploited to bypass local authentication checks. The vulnerability was disclosed on February 24, 2021 (CVE MITRE, Pega Advisory).

The vulnerability is classified as an authentication bypass issue, categorized under CWE-287 (Improper Authentication) (NVD CWE). The vulnerability specifically affects the password reset mechanism in the Pega Infinity platform, allowing potential circumvention of local authentication security controls.

The vulnerability could allow attackers to bypass local authentication checks through the password reset functionality, potentially compromising the security of affected Pega Infinity installations (Pega Advisory).

Pegasystems has released the A21 Hotfix series to address this vulnerability across all affected versions. For on-premise installations, specific hotfix IDs have been provided for each version (ranging from HFIX-69674 for version 8.2.1 to HFIX-69696 for version 8.5.2). Pega Cloud environments were proactively remediated by Pega. Organizations are advised to review the Security Checklist regularly (Pega Advisory).