PT-2023-15067 · Sailpoint+1 · Sailpoint Identityiq+1

Published 2023-01-31 · Updated 2023-02-08 · CVE-2022-46835

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SailPoint IdentityIQ versions 8.0 through 8.0p5 SailPoint IdentityIQ versions 8.1 through 8.1p6 SailPoint IdentityIQ versions 8.2 through 8.2p4 SailPoint IdentityIQ versions 8.3 through 8.3p1

Description The issue allows access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20.

Recommendations For SailPoint IdentityIQ versions 8.0 through 8.0p5, update to version 8.0p6 or later. For SailPoint IdentityIQ versions 8.1 through 8.1p6, update to version 8.1p7 or later. For SailPoint IdentityIQ versions 8.2 through 8.2p4, update to version 8.2p5 or later. For SailPoint IdentityIQ versions 8.3 through 8.3p1, update to version 8.3p2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-46835

Affected Products

Javaserver Faces

Sailpoint Identityiq

References · 6

• https://osv.dev/vulnerability/CVE-2022-46835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46835 · Security Note
• https://sailpoint.com/security-advisories/sailpoint-identityiq-file-traversal-vulnerability-cve-2022-46835 · Vendor Advisory
• https://t.me/cvenotify/43506 · Telegram Post
• https://t.me/cvenotify/43185 · Telegram Post
• https://t.me/cvenotify/43862 · Telegram Post