THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-3319

Security implication in SailPoint Identity Security Cloud IdentityProfile API Endpoints

Reserved:2024-04-04
Published:2024-05-15
Updated:2024-05-15

Description

An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administrator to execute user-defined templates as part of attribute transforms which could allow remote code execution on the host.



CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-94 Improper Control of Generation of Code ('Code Injection')

Product status

Default status
unaffected

Any version
affected

References

https://www.sailpoint.com/security-advisories/

cve.org CVE-2024-3319

nvd.nist.gov CVE-2024-3319

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-3319