CVE-2022-46835CWE-22

SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability

High · published January 31, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00935 · 60.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-01-31T00:00Z
EPSS history
Timeline
  • 31 JAN 00:00Z
    SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability
    cvelistv5