CVE-2022-45435: falha de média gravidade em SailPoint IdentityIQ
SailPoint IdentityIQ Access Control Bypass
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.4%
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
SailPoint · IdentityIQCVEs relacionadas — SailPoint IdentityIQ
No mesmo produto, das mais perigosas para as menos.
CVE-2022-46835HIGHSailPoint IdentityIQ JavaServer File Path Traversal VulnerabilityEPSS 0.9%CVE-2024-2227CRITICALIdentityIQ JavaServer Faces File Path Traversal VulnerabilityEPSS 0.8%CVE-2023-32217CRITICALSailPoint IdentityIQ Unsafe use of Reflection VulnerabilityEPSS 0.6%CVE-2024-2228HIGHIdentityIQ Authorization of QuickLink Target Identities VulnerabilityEPSS 0.4%CVE-2024-1714HIGHAccess Request for Entitlement Values with Leading/Trailing WhitespaceEPSS 0.3%