CVE-2022-46835 SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability
Attackers can read arbitrary files on the server filesystem via a path traversal flaw in the JSF component of SailPoint IdentityIQ.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-46835?
CVE-2022-46835 is a high-severity path traversal vulnerability in SailPoint IdentityIQ, published on 31 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.
Weakness: CWE-22
Which versions are affected by CVE-2022-46835?
It affects 1 product.
Products include Sailpoint Identityiq.
How do I fix CVE-2022-46835?
No fix has been published for CVE-2022-46835 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-46835 being exploited?
There is no known exploitation of CVE-2022-46835 in the wild and no public exploit code.
Other vulnerabilities in SailPoint IdentityIQ
- CVE-2024-10905 IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability
- CVE-2024-2227 IdentityIQ JavaServer Faces File Path Traversal Vulnerability
- CVE-2023-32217 SailPoint IdentityIQ Unsafe use of Reflection Vulnerability
- CVE-2026-12341 SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability
- CVE-2026-5712 IdentityIQ Role Editor Incorrect Authorization Vulnerability
Sources
Also known as GHSA-rhj5-wv7v-f365.