Saviynt Enterprise Identity Cloud vulnerable to local user enumeration and authentication bypass

guest · Dec 22, 2021

Vulnerability Note VU#692873
December 22, 2021

Overview
Saviynt Enterprise Identity Cloud contains user enumeration and authentication bypass vulnerabilities in the local password reset feature. Together, these vulnerabilities could allow a remote, unauthenticated attacker to gain administrative privileges if an SSO solution is not configured for authentication.
Impact
A remote, unauthenticated attacker can enumerate users and bypass authentication to change the password of an existing administrative user. The attacker can then perform administrative actions and possibly make changes to other connected authentication systems.
Click to expand...

Solution
Saviynt has deployed a backend update for the software that is intended to address the issue in Saviynt IGA Release v5.5 SP2.x and later versions. Saviynt has also blocked access to some of the URLs need to exploit these vulnerabilities.
Click to expand...

Log in or Sign up

Saviynt Enterprise Identity Cloud vulnerable to local user enumeration and authentication bypass

guest Guest

Log in or Sign up

Saviynt Enterprise Identity Cloud vulnerable to local user enumeration and authentication bypass

guest Guest

Useful Searches