CVE-2022-45435: medium-severity vulnerability in SailPoint IdentityIQ
SailPoint IdentityIQ Access Control Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.4%
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
SailPoint · IdentityIQRelated CVEs — SailPoint IdentityIQ
In the same product, most dangerous first.
CVE-2022-46835HIGHSailPoint IdentityIQ JavaServer File Path Traversal VulnerabilityEPSS 0.9%CVE-2024-2227CRITICALIdentityIQ JavaServer Faces File Path Traversal VulnerabilityEPSS 0.8%CVE-2023-32217CRITICALSailPoint IdentityIQ Unsafe use of Reflection VulnerabilityEPSS 0.6%CVE-2024-2228HIGHIdentityIQ Authorization of QuickLink Target Identities VulnerabilityEPSS 0.4%CVE-2024-1714HIGHAccess Request for Entitlement Values with Leading/Trailing WhitespaceEPSS 0.3%