PT-2022-16294 · Saviynt · Saviynt Enterprise Identity Cloud

Art Manion + 1 · Published 2022-01-24 · Updated 2023-08-08 · CVE-2022-23856

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Saviynt Enterprise Identity Cloud (EIC) version 5.5 SP2.x

Description An issue was discovered that allows an attacker to enumerate users by changing the id parameter in the "ECM/maintenance/forgotpasswordstep1" API endpoint.

Recommendations For Saviynt Enterprise Identity Cloud (EIC) version 5.5 SP2.x, consider restricting access to the "ECM/maintenance/forgotpasswordstep1" API endpoint to minimize the risk of exploitation. Avoid using the id parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-23856

Affected Products

Saviynt Enterprise Identity Cloud

References · 2

• 🔥 https://kb.cert.org/vuls/id/692873 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23856 · Security Note