CVE-2022-23855

Critical

An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in…

mitre·CWE-640·Published 2022-01-24

CVSS

9.8

EPSS

0.02

KEV

Exploits

cve.orgen

223 chars

An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep1 allows an unauthenticated user to reset passwords and login as any local account.

NVDen

223 chars

NVDes

262 chars

Se ha detectado un problema en Saviynt Enterprise Identity Cloud (EIC) versión 5.5 SP2.x. Una omisión de autenticación en ECM/maintenance/forgotpasswordstep1 permite a un usuario no autenticado restablecer contraseñas e iniciar sesión como cualquier cuenta local

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	7.5	10.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
3.1	Primary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H