title: SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability
description: IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
vendor: SailPoint
product: IdentityIQ
versions:
version: 8.3, status: affected, lessThanOrEqual: 8.3p1, versionType: custom
version: 8.2, status: affected, lessThanOrEqual: 8.2p4, versionType: custom
version: 8.1, status: affected, lessThanOrEqual: 8.1p6, versionType: custom
version: 8.0, status: affected, lessThanOrEqual: 8.0p5, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
]