CVE-2024-10905 — Improper Handling of File Names that Identify Virtual Resources in Technologies Identityiq

CWE-66 — Improper Handling of File Names that Identify Virtual Resources3 documents3 sources
Severity
9.8CRITICALNVD
CNA10.0
EPSS
1.0%
top 23.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sailpoint Technologies IdentityiqSailpoint Identityiq
Timeline
PublishedDec 2

Description

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5sailpoint_technologies/identityiq8.2 — 8.2p8+2

🔴Vulnerability Details

2
GHSA
GHSA-9jcj-c3px-4jc5: IdentityIQ 8↗2024-12-02
▶
CVEList
IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability↗2024-12-02
▶
CVE-2024-10905 — Technologies Identityiq vulnerability | cvebase