SailPoint IdentityIQ Unsafe use of Reflection Vulnerability- CVE-2023-32217

Description

This vulnerability allows an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.

Affected product and versions

  • IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2
  • IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5
  • IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p6
  • IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p5

Resolution

SailPoint has released e-fixes for each impacted and supported version of IdentityIQ. Future patch levels will include the fixes once they become available.

CVE details

CVE ID: CVE-2023-32217

Published Date: 05/31/2023

Vulnerability Type: Vulnerability Type Unsafe use of Reflection

CWE: CWE-470

CVSS v3 Score: 9.0

CVSS v3 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N