QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2024-2227

Back to search

CVE-2024-2227

Published: Mar 22, 2024

Modified: Aug 1, 2024

PUBLISHED

CVSS v3.1

10.0

CRITICAL

Description

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227.

VendorProductVersions

SailPoint

IdentityIQ

affected
8.1 - < 8.1p7
affected
8.2 - < 8.2p7
affected
8.3 - < 8.3p4
affected
8.4 - < 8.4p1

Weaknesses (CWE)

CWE-22

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now