SailPoint IdentityIQ JavaServer Faces File Path Traversal Vulnerability – CVE-2024-2227

Description

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227.

Affected product and versions

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p1

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p4

IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p7

IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7

All previous versions of IdentityIQ

Resolution

SailPoint has released e-fixes for each impacted and supported version of IdentityIQ. Future patch levels will include the fixes once they become available.

CVE details