CVE-2023-32217 : IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.

Published 2023-06-05 04:15:11

Updated 2023-06-12 18:27:46

Source SailPoint Technologies

View at NVD, CVE.org

Products affected by CVE-2023-32217

Sailpoint » Identityiq » Version: 8.3
cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.3 Update Patch1
cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.2 Update Patch1
cpe:2.3:a:sailpoint:identityiq:8.2:patch1:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.2 Update Patch2
cpe:2.3:a:sailpoint:identityiq:8.2:patch2:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.2 Update Patch4
cpe:2.3:a:sailpoint:identityiq:8.2:patch4:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.2
cpe:2.3:a:sailpoint:identityiq:8.2:-:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.1 Update Patch1
cpe:2.3:a:sailpoint:identityiq:8.1:patch1:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.1 Update Patch2
cpe:2.3:a:sailpoint:identityiq:8.1:patch2:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.1 Update Patch3
cpe:2.3:a:sailpoint:identityiq:8.1:patch3:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.1 Update Patch4
cpe:2.3:a:sailpoint:identityiq:8.1:patch4:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.1 Update Patch5
cpe:2.3:a:sailpoint:identityiq:8.1:patch5:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.1
cpe:2.3:a:sailpoint:identityiq:8.1:-:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.0 Update Patch1
cpe:2.3:a:sailpoint:identityiq:8.0:patch1:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.0 Update Patch2
cpe:2.3:a:sailpoint:identityiq:8.0:patch2:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.0 Update Patch3
cpe:2.3:a:sailpoint:identityiq:8.0:patch3:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.0 Update Patch4
cpe:2.3:a:sailpoint:identityiq:8.0:patch4:*:*:*:*:*:*
Matching versions
Sailpoint » Identityiq » Version: 8.0
cpe:2.3:a:sailpoint:identityiq:8.0:-:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-32217

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 42 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-32217

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	2.3	6.0	SailPoint Technologies
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-32217

CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
Assigned by:
- nvd@nist.gov (Primary)
- psirt@sailpoint.com (Secondary)

References for CVE-2023-32217

https://www.sailpoint.com/security-advisories/sailpoint-identityiq-unsafe-use-of-reflection-vulnerability-cve-2023-32217/

SailPoint IdentityIQ Unsafe use of Reflection Vulnerability- CVE-2023-32217 | SailPoint
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-32217

Products affected by CVE-2023-32217

Exploit prediction scoring system (EPSS) score for CVE-2023-32217

CVSS scores for CVE-2023-32217

CWE ids for CVE-2023-32217

References for CVE-2023-32217