Vulnerability · Published Jan 31, 2023 · Assigned by SailPoint
CVE-2022-45435SailPoint IdentityIQ Access Control Bypass
Medium 6.8
In plain English
A medium-severity incorrect authorization in IdentityIQ from SailPoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SailPoint | IdentityIQ | 8.3 – through 8.3p18.2 – through 8.2p48.1 – through 8.1p68.0 – through 8.0p5 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N