CVE-2019-16388

CVE-2019-16388 describes an information disclosure vulnerability in PEGA Platform 8.3.0. It allows an attacker to access audit log information by directly requesting prweb/sso/random_token/!STANDARD?pyStream=MyAlerts. The vendor clarified this access requires an administrator account, not a low-privilege one as initially claimed. The vulnerability has a CVSS score of 4.3 (Medium), indicating low attack complexity and no user interaction required, but only leads to limited confidentiality impact (information disclosure) without affecting integrity or availability. The attack vector is network-based. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The CVE has received minimal community discussion and media coverage, suggesting low public awareness and a lack of widespread attention.