Authentication Bypass in Saviynt Enterprise Identity Cloud
CVE-2022-23855

9.8CRITICAL

Key Information:

Vendor

Saviynt
Status
Enterprise Identity Cloud
Vendor
CVE Published:
24 January 2022

What is CVE-2022-23855?

An authentication bypass vulnerability was identified in Saviynt's Enterprise Identity Cloud version 5.5 SP2.x. This flaw occurs in the ECM/maintenance/forgotpasswordstep1 function, enabling unauthorized users to reset passwords for any local account. By exploiting this vulnerability, attackers can gain access to sensitive information and perform actions as an authenticated user without proper authorization.

References

https://www.kb.cert.org/vuls/id/692873
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2022-23855 : Authentication Bypass in Saviynt Enterprise Identity Cloud