CVE-2023-32217 — SailPoint IdentityIQ Unsafe use of Reflection Vulnerability

Description (CNA)

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.

Affected (CNA)

Vendor / product	Versions
SailPoint / IdentityIQ	affected 8.3 through 8.3p2; affected 8.2 through 8.2p5; affected 8.1 through 8.1p6; affected 8.0 through 8.0p5

CWE

CWE-470

References

https://www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/

ADP enrichment

CVE

No English description supplied.

https://www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/

CISA-ADP

No English description supplied.

No references supplied.