Paper/Archive/CVE-2024-10905

CVE-2024-10905

SailPoint Technologies IdentityIQ — IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability

EPSS 0.9%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 61.2.612 × 2012.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.

Affected

ProductAffectedFixed inSource

IdentityIQ8.2 – < 8.2p88.2p8CNA

IdentityIQ8.3 – < 8.3p58.3p5CNA

IdentityIQ8.4 – < 8.4p28.4p2CNA

identityiq8.2 – < 8.2p88.2p8CISA-ADP

identityiq8.3 – < 8.3p58.3p5CISA-ADP

identityiq8.4 – < 8.4p28.4p2CISA-ADP

Scores by source

SailPoint (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsailpoint.com/security-advisories/identityiq-improper-access-control-vulnerability-cve-2024-10905