CVE-2024-2227 - IdentityIQ JavaServer Faces File Path Traversal Vulnerability

Back Back to CVE browser

CRITICAL

IdentityIQ JavaServer Faces File Path Traversal Vulnerability

Published Mar 22, 2024

10.0

CRITICAL

CVSS 3.1

EPSS 0.78%

Description

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227.

Affected products

Vendor SailPoint Product IdentityIQ Default
n/a
- Version
  8.1
  Status
  affected
  Constraints
  <8.1p7
- Version
  8.2
  Status
  affected
  Constraints
  <8.2p7
- Version
  8.3
  Status
  affected
  Constraints
  <8.3p4
- Version
  8.4
  Status
  affected
  Constraints
  <8.4p1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SailPoint

IdentityIQ

n/a

Version	Status	Constraints
8.1	affected	<8.1p7
8.2	affected	<8.2p7
8.3	affected	<8.3p4
8.4	affected	<8.4p1

Vendor Sailpoint Product Identityiq Default
n/a
- Version
  8.1
  Status
  affected
  Constraints
  <8.1p7
- Version
  8.2
  Status
  affected
  Constraints
  <8.2p7
- Version
  8.3
  Status
  affected
  Constraints
  <8.3p4
- Version
  8.4
  Status
  affected
  Constraints
  <8.4p1