Lucene search

SailPointCVE-2023-32217

HistoryJun 05, 2023 - 4:15 a.m.

CVE-2023-32217

2023-06-0504:15:10

CWE-470

SailPoint

web.nvd.nist.gov

cve

identityiq

java

constructor

authentication

security vulnerability

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

40.0%

JSON

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.

Affected configurations

Nvd

Node

sailpointidentityiqMatch8.0-

sailpointidentityiqMatch8.0patch1

sailpointidentityiqMatch8.0patch2

sailpointidentityiqMatch8.0patch3

sailpointidentityiqMatch8.0patch4

sailpointidentityiqMatch8.1-

sailpointidentityiqMatch8.1patch1

sailpointidentityiqMatch8.1patch2

sailpointidentityiqMatch8.1patch3

sailpointidentityiqMatch8.1patch4

sailpointidentityiqMatch8.1patch5

sailpointidentityiqMatch8.2-

sailpointidentityiqMatch8.2patch1

sailpointidentityiqMatch8.2patch2

sailpointidentityiqMatch8.2patch4

sailpointidentityiqMatch8.3-

sailpointidentityiqMatch8.3patch1

VendorProductVersionCPE
sailpointidentityiq8.0cpe:2.3:a:sailpoint:identityiq:8.0:-:*:*:*:*:*:*
sailpointidentityiq8.0cpe:2.3:a:sailpoint:identityiq:8.0:patch1:*:*:*:*:*:*
sailpointidentityiq8.0cpe:2.3:a:sailpoint:identityiq:8.0:patch2:*:*:*:*:*:*
sailpointidentityiq8.0cpe:2.3:a:sailpoint:identityiq:8.0:patch3:*:*:*:*:*:*
sailpointidentityiq8.0cpe:2.3:a:sailpoint:identityiq:8.0:patch4:*:*:*:*:*:*
sailpointidentityiq8.1cpe:2.3:a:sailpoint:identityiq:8.1:-:*:*:*:*:*:*
sailpointidentityiq8.1cpe:2.3:a:sailpoint:identityiq:8.1:patch1:*:*:*:*:*:*
sailpointidentityiq8.1cpe:2.3:a:sailpoint:identityiq:8.1:patch2:*:*:*:*:*:*
sailpointidentityiq8.1cpe:2.3:a:sailpoint:identityiq:8.1:patch3:*:*:*:*:*:*
sailpointidentityiq8.1cpe:2.3:a:sailpoint:identityiq:8.1:patch4:*:*:*:*:*:*

Vendor	Product	Version	CPE
sailpoint	identityiq	8.0	cpe:2.3:a:sailpoint:identityiq:8.0:-::::::
sailpoint	identityiq	8.0	cpe:2.3:a:sailpoint:identityiq:8.0:patch1::::::
sailpoint	identityiq	8.0	cpe:2.3:a:sailpoint:identityiq:8.0:patch2::::::
sailpoint	identityiq	8.0	cpe:2.3:a:sailpoint:identityiq:8.0:patch3::::::
sailpoint	identityiq	8.0	cpe:2.3:a:sailpoint:identityiq:8.0:patch4::::::
sailpoint	identityiq	8.1	cpe:2.3:a:sailpoint:identityiq:8.1:-::::::
sailpoint	identityiq	8.1	cpe:2.3:a:sailpoint:identityiq:8.1:patch1::::::
sailpoint	identityiq	8.1	cpe:2.3:a:sailpoint:identityiq:8.1:patch2::::::
sailpoint	identityiq	8.1	cpe:2.3:a:sailpoint:identityiq:8.1:patch3::::::
sailpoint	identityiq	8.1	cpe:2.3:a:sailpoint:identityiq:8.1:patch4::::::

Rows per page:

1-10 of 171

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "IdentityIQ",
    "vendor": "SailPoint",
    "versions": [
      {
        "lessThanOrEqual": "8.3p2",
        "status": "affected",
        "version": "8.3",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.2p5",
        "status": "affected",
        "version": "8.2",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.1p6",
        "status": "affected",
        "version": "8.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.0p5",
        "status": "affected",
        "version": "8.0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

40.0%

JSON

Related for CVE-2023-32217