Question
Societe Generale
IN
Last activity: 25 Feb 2020 5:35 EST
Access - When click on links in navigation/menu
Hi ,
We can restrict users menu links/items in navigation rule based on privileges. But client raised vulnerability issue stating ,users are able to access the portals/UI which we see when clicking on menu items ,which are not accessible to some users. But by changing URL / script in back-end they are accessing the UI . Is there any way to restrict users when they change URL parameters to access the items which they don't have access to.
This is a kind of security issue, which makes users access the functionalities which they don't have access to.
***Edited by Moderator Marissa to change type from Pega Academy to Product, update Product details and platform capability tags****
Areteans
IN
Hello Suresh,
As this is a security hotfix, I am not sure if I can share it here or not. So I have dropped a message to you with the hotfix number.
Societe Generale
IN
Hi Nagendra,
For Example:i logged in as read only operator, who doesnot have access to bulk actions. But by modifying url readonly user is able to access bulk actions portal. can we restrict this?
Client security team raised this , by modifying parameters in url and http request they are able to see screens which they dont have access to
Pegasystems Inc.
US
Please let us know the SR ID for the Support Request you open to obtain the Hotfix @SureshB9520 so that we may track for you.
Thanks!
Marissa | Senior Moderator | Pegasystems Inc.