CVE-2024-2227: falha crítica em SailPoint IdentityIQ
IdentityIQ JavaServer Faces File Path Traversal Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 0.8%
This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
SailPoint · IdentityIQCVEs relacionadas — SailPoint IdentityIQ
No mesmo produto, das mais perigosas para as menos.
CVE-2022-46835HIGHSailPoint IdentityIQ JavaServer File Path Traversal VulnerabilityEPSS 0.9%CVE-2023-32217CRITICALSailPoint IdentityIQ Unsafe use of Reflection VulnerabilityEPSS 0.6%CVE-2022-45435MEDIUMSailPoint IdentityIQ Access Control BypassEPSS 0.4%CVE-2024-2228HIGHIdentityIQ Authorization of QuickLink Target Identities VulnerabilityEPSS 0.4%CVE-2024-1714HIGHAccess Request for Entitlement Values with Leading/Trailing WhitespaceEPSS 0.3%