CVE-2024-2227

The vulnerability results from a path traversal flaw present in the JavaServer Faces (JSF) 2.2.20 library, originally documented in CVE-2020-6950. SailPoint issued earlier patches in May 2021 (ETN IIQSAW-3585) and in January 2024 (IIQFW-336), however CVE-2024-2227 indicates the need for additional changes as part of the remediation. An attacker, without any authentication, can craft an HTTP request containing path traversal sequences to escape the allowed application directory and read server system files.

An attacker can gain unauthorized access to arbitrary operating system files on the server, which may lead to disclosure of sensitive configuration data, credentials, private keys, or other sensitive information. Due to the scope of the vulnerability (high scores for confidentiality, integrity, and availability in CVSS), the impact may include complete takeover of control over the application environment.

Patches available from the vendor should be applied according to the references (https://www.sailpoint.com/security-advisories/). The patch complements earlier remediation measures IIQSAW-3585 (May 2021) and IIQFW-336 (January 2024) and should be installed immediately.

SailPoint IdentityIQ — versions indicated in vendor references (SailPoint Security Advisories)