GCVE - cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*

part: a version: 8.3 update: patch1

Vendor	Sailpoint (`6a1c15da-d739-5b75-a086-13b5ee55862f`)
Product	Identityiq (`bd66fbfd-b9e0-5420-934e-b27cb1ae8b6f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-5712`	vulnerable	2026-06-08 08:07:04.008215	IdentityIQ Role Editor Incorrect Authorization Vulnerability HIGH (8) This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing. Published: 2026-04-29T17:18:27.748Z Updated: 2026-04-30T03:56:06.567Z Open on db.gcve.eu Reference links https://www.sailpoint.com/security-advisories/sailpoint-identityiq-role-editor-incorrect-authorization-vulnerability-cve-2026-5712	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10280`	vulnerable	2026-06-08 07:02:26.647766	Incorrect Content Type Cross-Site Scripting Vulnerability HIGH (7.1) IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS). Published: 2025-11-03T16:35:56.241Z Updated: 2026-02-26T17:47:39.634Z Open on db.gcve.eu Reference links https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2228`	vulnerable	2026-06-08 06:33:30.674276	IdentityIQ Authorization of QuickLink Target Identities Vulnerability HIGH (7.1) This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population. Published: 2024-03-22T15:50:09.729Z Updated: 2024-08-01T19:03:39.121Z Open on db.gcve.eu Reference links https://www.sailpoint.com/security-advisories/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2227`	vulnerable	2026-06-08 06:33:30.667826	IdentityIQ JavaServer Faces File Path Traversal Vulnerability CRITICAL (10) This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227. Published: 2024-03-22T15:43:12.869Z Updated: 2024-08-01T19:03:39.142Z Open on db.gcve.eu Reference links https://www.sailpoint.com/security-advisories/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1714`	vulnerable	2026-06-08 06:27:14.177364	Access Request for Entitlement Values with Leading/Trailing Whitespace HIGH (7.1) An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request. Published: 2024-02-21T16:57:19.298Z Updated: 2025-08-26T20:08:09.865Z Open on db.gcve.eu Reference links https://www.sailpoint.com/security-advisories/sailpoint-identityiq-access-request-for-entitlement-values-with-leading-trailing-whitespace-cve-2024-1714/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-10905`	vulnerable	2026-06-08 06:23:47.979940	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-32217`	vulnerable	2026-06-08 06:04:45.167322	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-46835`	vulnerable	2026-06-08 05:50:39.595865	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-45435`	vulnerable	2026-06-08 05:50:36.336711	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.