SailPoint IdentityIQ File Traversal Vulnerability – CVE-2022-46835

Description

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, and IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950

Affected product and versions

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2

IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5

IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7

IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6

Resolution

SailPoint has released an e-fix that addresses this issue across all impacted version of IdentityIQ. Future patch levels will include this fix once they become available.

CVE details

CVE ID: CVE-2022-46835

Published Date: 01/31/2023

Vulnerability Type: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

CWE: CWE-22

CVSS v3 Score: 8.8

CVSS v3 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N