PT-2023-14664 · Sailpoint · Identityiq

Published 2023-01-31 · Updated 2026-05-14 · CVE-2022-45435

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IdentityIQ versions 8.3 through 8.3p1 IdentityIQ versions 8.2 through 8.2p4 IdentityIQ versions 8.1 through 8.1p6 IdentityIQ versions 8.0 through 8.0p5 IdentityIQ versions prior to 8.0

Description The issue allows authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.

Recommendations For IdentityIQ versions 8.3 through 8.3p1, update to version 8.3p2 or later. For IdentityIQ versions 8.2 through 8.2p4, update to version 8.2p5 or later. For IdentityIQ versions 8.1 through 8.1p6, update to version 8.1p7 or later. For IdentityIQ versions 8.0 through 8.0p5, update to version 8.0p6 or later. For IdentityIQ versions prior to 8.0, update to version 8.0p6 or later. As a temporary workaround, consider restricting the SetIdentityForwarding right to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-45435

Affected Products

Identityiq

References · 5

• https://sailpoint.com/security-advisories/sailpoint-identityiq-identity-forwarding-vulnerability-cve-2022-45435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45435 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45435 · Vendor Advisory
• https://t.me/cvenotify/43186 · Telegram Post
• https://twitter.com/dailycve/status/2054961808939581896 · Twitter Post