VYPR
← All advisories
Critical severity10.0NVD Advisory· Published Mar 22, 2024· Updated Jun 17, 2026

CVE-2024-2227

CVE-2024-2227

Description

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227.

Affected products

18
  • Sailpoint/Identityiq18 versions
    cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:*+ 17 more
    • cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:*range: <8.1
    • cpe:2.3:a:sailpoint:identityiq:8.1:patch1:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.1:patch2:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.1:patch3:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.1:patch4:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.1:patch5:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.1:patch6:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.2:-:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.2:patch1:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.2:patch2:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.2:patch4:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.2:patch5:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.3:patch2:*:*:*:*:*:*
    • cpe:2.3:a:sailpoint:identityiq:8.4:-:*:*:*:*:*:*
    • (no CPE)range: 2.2.20
    • (no CPE)range: 8.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.