PT-2022-16293 · Saviynt · Saviynt Enterprise Identity Cloud

Published 2022-01-24 · Updated 2023-08-08 · CVE-2022-23855

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Saviynt Enterprise Identity Cloud (EIC) version 5.5 SP2.x

Description An issue was discovered that allows an authentication bypass. Specifically, the endpoint /ECM/maintenance/forgotpasswordstep1 is vulnerable, enabling an unauthenticated user to reset passwords and login as any local account.

Recommendations For version 5.5 SP2.x, consider restricting access to the /ECM/maintenance/forgotpasswordstep1 endpoint until a patch is available. As a temporary workaround, disabling the password reset functionality for local accounts may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2022-23855

Affected Products

Saviynt Enterprise Identity Cloud

References · 2

• 🔥 https://kb.cert.org/vuls/id/692873 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23855 · Security Note