SailPoint vulnerabilities
We track 7 vulnerabilities in SailPoint products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on December 2, 2024.
Latest SailPoint vulnerabilities
- 9.8 Critical severity
IdentityIQ: Improper Handling of File Names that Identify Virtual Resources
IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ applicati
- 9.1 Critical severity
Identity Security Cloud: Improper Control of Generation of Code
An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administrator to execute user-defined templates as part of attribute transforms which could allow remote code
- 8.8 High severity
IdentityIQ: Improper Privilege Management
This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population.
- 7.5 High severity
IdentityIQ: Improper Limitation of a Pathname to a Restricted Directory
This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix
- 7.1 High severity
An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if…
An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request.
- 8.8 High severity
IdentityIQ: Use of Externally-Controlled Input to Select Classes or Code
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke
- 7.5 High severity
IdentityIQ: Improper Limitation of a Pathname to a Restricted Directory
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in th