Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2023-32217

SailPoint IdentityIQ Unsafe use of Reflection Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
SailPoint

Description

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SailPoint IdentityIQ

Default version status: unknown

  • 8.3 to ≤ 8.3p2affected
  • 8.2 to ≤ 8.2p5affected
  • 8.1 to ≤ 8.1p6affected
  • 8.0 to ≤ 8.0p5affected

References