Customer Notice: IIQ Service Catalog credential exposure (Support KB)

Announcements Product News
, ,
1

Product

  • SailPoint IdentityIQ for ServiceNow Service Catalog (ServiceNow Store application)

Affected versions

  • IdentityIQ for ServiceNow Service Catalog 3.0

  • IdentityIQ for ServiceNow Service Catalog 3.1

  • IdentityIQ for ServiceNow Service Catalog 3.2

This notice applies only to the IdentityIQ Service Catalog application.

Issue

In affected versions, the Manage Access experience in the ServiceNow Service Portal can include IdentityIQ integration configuration data in a client-side response. A user who can use Manage Access and inspect browser Developer Tools (for example, the Network or response payload) may be able to view sensitive configuration values associated with the IdentityIQ connection.

SailPoint has prepared version-specific Update Sets that limit the Manage Access widget response to only the non-sensitive fields required by the UI. Server-side authentication and REST integrations are unchanged.

Impact

  • Who is affected: Customers running IdentityIQ for ServiceNow Service Catalog versions 3.0, 3.1, or 3.2 who use the Manage Access page.

  • Risk: Users with access to Manage Access may be able to view sensitive configuration values that should remain server-side only.

  • Functional impact of the fix: Access request submission and comment validation continue to work as expected after the Update Set is applied.

Resolution

Apply the SailPoint-provided version-specific Update Set for your installed Catalog application version (3.0, 3.1, or 3.2).

How to obtain the Update Set

  1. Open a case with SailPoint Support.

  2. Reference this knowledge article and request the EFIX-4277 / ServiceNow Catalog Configuration Refinement Update Set for your installed version (3.0, 3.1, or 3.2).

  3. Support will provide the matching Update Set package and any accompanying installation notes.

How to install the Update Set

  1. Log in to the ServiceNow instance as an administrator (or a user with the admin role).

  2. Confirm you are in the correct application scope for the SailPoint IdentityIQ Service Catalog application.

  3. Navigate to System Update Sets > Retrieved Update Sets.

  4. Select Import Update Set from XML, choose the Update Set XML file provided by Support, and upload it.

  5. Open the loaded Update Set, select Preview Update Set, and resolve any conflicts if prompted (typically accept the remote update for SailPoint Catalog widget changes).

  6. Select Commit Update Set and wait until the commit completes successfully.

  7. Optionally clear the instance cache (cache.do) and retest Manage Access in the Service Portal.

Recommended security follow-up

After applying the Update Set, SailPoint recommends that you rotate the IdentityIQ credentials and any related client credentials configured for the Service Catalog integration, in accordance with your organization’s credential-management policy. Treat previously used credentials as potentially viewed until rotation is complete.

Validation

After committing the Update Set:

  1. Open the Service Portal and launch Manage Access.

  2. Submit a standard access request while monitoring browser Developer Tools.

  3. Confirm that sensitive IdentityIQ connection are no longer present in the Manage Access widget / client response.

  4. Confirm that comment requirements and access request submission still succeed.

Permanent fix

This remediation will also be included in a upcoming release of the IdentityIQ for ServiceNow Service Catalog application v3.3. Customers on 3.0–3.2 should apply the Update Set now and plan to upgrade to the fixed store release when it becomes available.

Additional information

  • If you need assistance identifying your installed Catalog version, applying the Update Set, or validating the fix, contact SailPoint Support.
1 Like