Vulnerability · Published Jan 31, 2023 · Assigned by SailPoint
CVE-2022-46835SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability
High 8.8
In plain English
A high-severity path traversal in IdentityIQ from SailPoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Official description
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SailPoint | IdentityIQ | 8.3 – through 8.3p18.2 – through 8.2p48.1 – through 8.1p68.0 – through 8.0p5 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H