IdentityIQ Improper Access Control Vulnerability – CVE-2024-10905

Description

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.

Affected product and versions

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5

IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8

All previous versions of IdentityIQ

No other SailPoint products are impacted

Resolution

SailPoint has released e-fixes for each impacted and supported version of IdentityIQ. Future patch levels will include the fixes once they become available.

CVE details

CVE ID: CVE-2024-10905

Published Date: 12/02/2024

Vulnerability Type: IdentityIQ Improper Access Control Vulnerability

CWE: CWE-66

CVSS v3 Score: 10.0

CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H