CVE-2022-22950: - Spring Framework Security Vulnerability

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

Is IM impacted by the Spring vulnerability CVE-2022-22950?

Environment

All Identity Manager

Resolution

 IDM is not vulnerable with CVE-2022-22950.

Identity Manager is not using SpEL related classes or jars.

 

Additional Information

Beyond this, The Suite software has been designed with file upload size restrictions, as well as code validation, to prevent exactly this type of vulnerability from being exploited within the software.