CVE-2023-32217

CRITICAL9.0

SailPoint IdentityIQ Unsafe use of Reflection Vulnerability

Published May 31, 2023

Modified 1 years ago

Details

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.

References

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2023-32217

WEB

https://www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/

CVSS Analysis

CVSS v3.1

9.0

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness Type (CWE)

Other

CWE-470

Ecosystems

Timeline

PublishedMay 31, 2023

ModifiedJan 10, 2025