CVE-2022-45435CWE-863

SailPoint IdentityIQ Access Control Bypass

Medium · published January 31, 2023

CVSS v3.1
6.8
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-01-31T00:00Z
EPSS history
Timeline
  • 31 JAN 00:00Z
    SailPoint IdentityIQ Access Control Bypass
    cvelistv5