2 lines
6.0 KiB
JSON
2 lines
6.0 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"IdentityIQ","vendor":"SailPoint","versions":[{"lessThan":"8.1p7","status":"affected","version":"8.1","versionType":"semver"},{"lessThan":"8.2p7","status":"affected","version":"8.2","versionType":"semver"},{"lessThan":"8.3p4","status":"affected","version":"8.3","versionType":"semver"},{"lessThan":"8.4p1","status":"affected","version":"8.4","versionType":"semver"}]}],"source":"psirt@sailpoint.com"},{"affectedData":[{"cpes":["cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"identityiq","vendor":"sailpoint","versions":[{"lessThan":"8.1p7","status":"affected","version":"8.1","versionType":"custom"},{"lessThan":"8.2p7","status":"affected","version":"8.2","versionType":"custom"},{"lessThan":"8.3p4","status":"affected","version":"8.3","versionType":"custom"},{"lessThan":"8.4p1","status":"affected","version":"8.4","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:*","matchCriteriaId":"C76617A8-395F-4165-983E-9B9E77DFAA10","versionEndExcluding":"8.1","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.1:patch1:*:*:*:*:*:*","matchCriteriaId":"216615A8-0E21-4597-871C-AC121BF0E150","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.1:patch2:*:*:*:*:*:*","matchCriteriaId":"35ECC22F-B2A2-4750-B995-2944F12C1BFF","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.1:patch3:*:*:*:*:*:*","matchCriteriaId":"9ECEF57B-DA34-402A-86F0-713A3683A172","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.1:patch4:*:*:*:*:*:*","matchCriteriaId":"1815D4C7-50FC-45DA-8130-E9258CAFBD09","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.1:patch5:*:*:*:*:*:*","matchCriteriaId":"F784765E-8B3C-4F96-B57A-E6E7AECE628C","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.1:patch6:*:*:*:*:*:*","matchCriteriaId":"A7B4F481-4E74-4B56-9851-E1A665F5783D","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.2:-:*:*:*:*:*:*","matchCriteriaId":"224129BF-667F-4F6A-8E9A-15390F6FA3D5","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.2:patch1:*:*:*:*:*:*","matchCriteriaId":"2A8C2668-C1F1-4A67-A2B3-99B5746C6A52","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.2:patch2:*:*:*:*:*:*","matchCriteriaId":"A9D91EB5-EC8E-4200-9245-13E37312343D","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.2:patch4:*:*:*:*:*:*","matchCriteriaId":"63352C53-ADD8-49CD-B9E6-648183BDED68","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.2:patch5:*:*:*:*:*:*","matchCriteriaId":"DBDD484D-BF0D-4246-9701-0BF3DD2194E4","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:*","matchCriteriaId":"1173CC53-CBE5-450C-96BF-8583D1B3D185","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*","matchCriteriaId":"2C0F5E55-5D33-425F-9DA7-49FE66CD84C4","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.3:patch2:*:*:*:*:*:*","matchCriteriaId":"1A2FD228-E6DB-49E3-BE3E-1BF9B0434FC0","vulnerable":true},{"criteria":"cpe:2.3:a:sailpoint:identityiq:8.4:-:*:*:*:*:*:*","matchCriteriaId":"4BC4F08D-A3FB-41F6-8EFD-6F34FBC0F75F","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227."},{"lang":"es","value":"Esta vulnerabilidad permite el acceso a archivos arbitrarios en el sistema de archivos del servidor de aplicaciones debido a una vulnerabilidad de path traversal en JavaServer Faces (JSF) 2.2.20 documentada en CVE-2020-6950. La solución para esta vulnerabilidad contenida en esta solución de seguridad proporciona cambios adicionales a la solución anunciada en mayo de 2021 rastreada por ETN IIQSAW-3585 y en enero de 2024 rastreada por IIQFW-336. Esta vulnerabilidad en IdentityIQ tiene asignada CVE-2024-2227."}],"id":"CVE-2024-2227","lastModified":"2026-06-17T07:23:58.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"psirt@sailpoint.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-2227","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-03-30T04:00:58.434391Z","version":"2.0.3"}}]},"published":"2024-03-22T16:15:09.253","references":[{"source":"psirt@sailpoint.com","tags":["Vendor Advisory"],"url":"https://www.sailpoint.com/security-advisories/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.sailpoint.com/security-advisories/"}],"sourceIdentifier":"psirt@sailpoint.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@sailpoint.com","type":"Secondary"}]}
|