CVE-2022-46835

Опубликовано: 31 янв. 2023

Источник: nvd

CVSS3: 8.8

CVSS3: 7.5

EPSS Низкий

Описание

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sailpoint:identityiq:8.0:-:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.0:patch1:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.0:patch2:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.0:patch3:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.0:patch4:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.0:patch5:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.1:-:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.1:patch1:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.1:patch2:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.1:patch3:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.1:patch4:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.1:patch5:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.1:patch6:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.2:-:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.2:patch1:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.2:patch2:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.2:patch4:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:*

cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.00563

Низкий

8.8 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

GHSA-rhj5-wv7v-f365

CVSS3: 7.5

github

около 3 лет назад

IdentitylQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentitylQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentitylQ 8.1 and all 8.1 patch levels prior to 8.1p7, Identity|Q 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.

EPSS

Процентиль: 68%

0.00563

Низкий

8.8 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-22