IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.
References
Configurations
Configuration 1 (hide)
|
History
12 Jun 2023, 18:27
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Sailpoint identityiq
Sailpoint |
|
| CWE | CWE-470 | |
| References | (MISC) https://www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/ - Vendor Advisory | |
| CPE | cpe:2.3:a:sailpoint:identityiq:8.1:-:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.0:-:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.2:patch2:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.2:-:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.1:patch1:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.0:patch4:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.2:patch1:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.0:patch1:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.2:patch4:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.1:patch4:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.1:patch2:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.1:patch3:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.1:patch5:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.0:patch2:*:*:*:*:*:* cpe:2.3:a:sailpoint:identityiq:8.0:patch3:*:*:*:*:*:* |
05 Jun 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-05 04:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-32217
Mitre link : CVE-2023-32217
CVE.ORG link : CVE-2023-32217
JSON object : View
Products Affected
sailpoint
- identityiq
CWE
CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')