Lucene search

SailPointCVELIST:CVE-2023-32217

HistoryMay 31, 2023 - 12:00 a.m.

CVE-2023-32217 SailPoint IdentityIQ Unsafe use of Reflection Vulnerability

2023-05-3100:00:00

CWE-470

SailPoint

www.cve.org

sailpoint

identityiq

reflectionvulnerability

cve-2023-32217

javaconstructor

authentication

patchlevels

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

40.0%

JSON

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "IdentityIQ",
    "vendor": "SailPoint",
    "versions": [
      {
        "lessThanOrEqual": "8.3p2",
        "status": "affected",
        "version": "8.3",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.2p5",
        "status": "affected",
        "version": "8.2",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.1p6",
        "status": "affected",
        "version": "8.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.0p5",
        "status": "affected",
        "version": "8.0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

40.0%

JSON

Related for CVELIST:CVE-2023-32217