CVE-2024-2228

Published: Mar 22, 2024Modified: Nov 12, 2025

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population.

Affected (16)

Products: Sailpoint: Identityiq

Sailpoint

1 product

Identityiq

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Sailpoint Identityiq	Before 8.1
Sailpoint Identityiq	Version 8.1 patch1
Sailpoint Identityiq	Version 8.1 patch2
Sailpoint Identityiq	Version 8.1 patch3
Sailpoint Identityiq	Version 8.1 patch4
Sailpoint Identityiq	Version 8.1 patch5
Sailpoint Identityiq	Version 8.1 patch6
Sailpoint Identityiq	Version 8.2
Sailpoint Identityiq	Version 8.2 patch1
Sailpoint Identityiq	Version 8.2 patch2
Sailpoint Identityiq	Version 8.2 patch4
Sailpoint Identityiq	Version 8.2 patch5
Sailpoint Identityiq	Version 8.3
Sailpoint Identityiq	Version 8.3 patch1
Sailpoint Identityiq	Version 8.3 patch2
Sailpoint Identityiq	Version 8.4

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (2)

https://www.sailpoint.com/security-advisories/

Source: psirt@sailpoint.com

Vendor Advisory

https://www.sailpoint.com/security-advisories/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.