Vulnerability · Published May 31, 2023 · Assigned by SailPoint
CVE-2023-32217SailPoint IdentityIQ Unsafe use of Reflection Vulnerability
Critical 9.0
In plain English
A critical-severity security flaw in IdentityIQ from SailPoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SailPoint | IdentityIQ | 8.3 – through 8.3p28.2 – through 8.2p58.1 – through 8.1p68.0 – through 8.0p5 |
Weakness: CWE-470 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H