PT-2024-25145 · Sailpoint · Sailpoint Identity Security Cloud

Published 2024-05-15 · Updated 2024-07-08 · CVE-2024-3319

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SailPoint Identity Security Cloud (affected versions not specified)

Description An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administrator to execute user-defined templates as part of attribute transforms, which could allow remote code execution on the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-3319

Affected Products

Sailpoint Identity Security Cloud

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-3319 · Security Note
• https://sailpoint.com/security-advisories · Note
• https://twitter.com/oktsec/status/1810541786193932631 · Twitter Post
• https://t.me/cvenotify/79862 · Telegram Post