CVE-2022-45435: SailPoint IdentityIQ Access Control Bypass
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-45435?
The severity of CVE-2022-45435 is medium with a CVSS score of 6.5.
What versions of IdentityIQ are affected by CVE-2022-45435?
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions are affected by CVE-2022-45435.
How can I fix CVE-2022-45435?
To fix CVE-2022-45435, it is recommended to upgrade to IdentityIQ 8.3p2, 8.2p5, 8.1p7, or 8.0p6.
What is the CWE of CVE-2022-45435?
The CWE of CVE-2022-45435 is CWE-863.
Where can I find more information about CVE-2022-45435?
More information about CVE-2022-45435 can be found at the following reference: [link](https://www.sailpoint.com/security-advisories/sailpoint-identityiq-identity-forwarding-vulnerability-cve-2022-45435/)