{"id":"CVE-2024-10905","state":"PUBLISHED","title":"IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability","description":"IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.","publishedAt":"2024-12-02T14:49:51.199Z","updatedAt":"2025-01-06T17:42:22.215Z","severity":{"score":10,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"SailPoint"},"assigner":"SailPoint","products":["SailPoint Technologies IdentityIQ"],"affected":[{"vendor":"SailPoint Technologies","product":"IdentityIQ","defaultStatus":"affected","versions":[{"version":"8.2","status":"affected","lessThan":"8.2p8","versionType":"semver"},{"version":"8.3","status":"affected","lessThan":"8.3p5","versionType":"semver"},{"version":"8.4","status":"affected","lessThan":"8.4p2","versionType":"semver"}]}],"references":["https://www.sailpoint.com/security-advisories/identityiq-improper-access-control-vulnerability-cve-2024-10905"],"weaknesses":["CWE-66"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/10xxx/CVE-2024-10905.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-10905","state":"PUBLISHED","datePublished":"2024-12-02T14:49:51.199Z","dateUpdated":"2025-01-06T17:42:22.215Z","assignerShortName":"SailPoint","assignerOrgId":"2cfc7547-56a0-4049-8b52-c3078e8a8719","dateReserved":"2024-11-05T20:21:47.258Z"},"containers":{"cna":{"title":"IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability","descriptions":[{"lang":"en","value":"IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected."}],"affected":[{"vendor":"SailPoint Technologies","product":"IdentityIQ","defaultStatus":"affected","versions":[{"version":"8.2","status":"affected","lessThan":"8.2p8","versionType":"semver"},{"version":"8.3","status":"affected","lessThan":"8.3p5","versionType":"semver"},{"version":"8.4","status":"affected","lessThan":"8.4p2","versionType":"semver"}]}],"references":[{"url":"https://www.sailpoint.com/security-advisories/identityiq-improper-access-control-vulnerability-cve-2024-10905"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-66","description":"CWE-66: Improper Handling of File Names that Identify Virtual Resources","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"SailPoint","orgId":"2cfc7547-56a0-4049-8b52-c3078e8a8719","dateUpdated":"2024-12-06T17:57:12.682Z"},"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<a target=\"_blank\" rel=\"nofollow\" href=\"https://community.sailpoint.com/t5/IdentityIQ-Blog/IdentityIQ-Improper-Access-Control-Vulnerability/ba-p/261409\">https://community.sailpoint.com/t5/IdentityIQ-Blog/IdentityIQ-Improper-Access-Control-Vulnerability/...</a>"}],"value":"https://community.sailpoint.com/t5/IdentityIQ-Blog/IdentityIQ-Improper-Access-Control-Vulnerability/... https://community.sailpoint.com/t5/IdentityIQ-Blog/IdentityIQ-Improper-Access-Control-Vulnerability/ba-p/261409"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"sailpoint","product":"identityiq","defaultStatus":"unknown","versions":[{"version":"8.2","status":"affected","lessThan":"8.2p8","versionType":"semver"},{"version":"8.3","status":"affected","lessThan":"8.3p5","versionType":"semver"},{"version":"8.4","status":"affected","lessThan":"8.4p2","versionType":"semver"}],"cpes":["cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-03T04:55:24.996838Z","id":"CVE-2024-10905","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-06T17:42:22.215Z"}}]}}}