What’s Vulnerable › Vulnerabilities

CVE-2024-2227: IdentityIQ JavaServer Faces File Path Traversal Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-22 · updated 2026-06-17
• Weakness: CWE-22

Description

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227.

Affected products

• SailPoint IdentityIQ: before 8.1; 8.1-patch1, 8.1-patch2, 8.1-patch3, 8.1-patch4, 8.1-patch5, 8.1-patch6 (+9) — fixed in 8.1

How to fix

Upgrade to a fixed version: SailPoint IdentityIQ 8.1. Check the vendor advisory for mitigations.

References

• https://www.sailpoint.com/security-advisories/
• https://www.sailpoint.com/security-advisories/

Get alerted when CVE-2024-2227 or the next vulnerability affects your stack