CVE-2024-3319 Security implication in SailPoint Identity Security Cloud IdentityProfile API Endpoints
Authenticated administrators can execute arbitrary code via user-defined templates in IdentityProfile API endpoints, leading to remote code execution on the host.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3319?
CVE-2024-3319 is a critical code injection vulnerability in SailPoint Identity Security Cloud, published on 15 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administrator to execute user-defined templates as part of attribute transforms which could allow remote code execution on the host.
Weakness: CWE-94
Which versions are affected by CVE-2024-3319?
How do I fix CVE-2024-3319?
No fix has been published for CVE-2024-3319 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-3319 being exploited?
There is no known exploitation of CVE-2024-3319 in the wild and no public exploit code.
Sources
Also known as GHSA-c24r-pxmj-hx9h.