by Kastro
Paper/Archive/CVE-2024-2227

CVE-2024-2227

SailPoint IdentityIQ — IdentityIQ JavaServer Faces File Path Traversal Vulnerability

EPSS 0.8%CVSS 10.0
critical.is priorityof 100
41
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227.

Affected

ProductAffectedFixed inSource
IdentityIQ8.1 – < 8.1p78.1p7CNA
IdentityIQ8.2 – < 8.2p78.2p7CNA
IdentityIQ8.3 – < 8.3p48.3p4CNA
IdentityIQ8.4 – < 8.4p18.4p1CNA
identityiq8.1 – < 8.1p78.1p7CISA-ADP
identityiq8.2 – < 8.2p78.2p7CISA-ADP
identityiq8.3 – < 8.3p48.3p4CISA-ADP
identityiq8.4 – < 8.4p18.4p1CISA-ADP

Scores by source

SailPoint (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsailpoint.com/security-advisories