CVE-2024-10905 IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability
Attackers can access protected static content in the IdentityIQ application directory via HTTP/HTTPS, leading to potential information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10905?
CVE-2024-10905 is a critical missing authorization vulnerability in SailPoint Technologies IdentityIQ, published on 2 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.
Weakness: CWE-66
Which versions are affected by CVE-2024-10905?
It affects 1 product.
Products include Sailpoint Identityiq.
How do I fix CVE-2024-10905?
No fix has been published for CVE-2024-10905 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-10905 being exploited?
There is no known exploitation of CVE-2024-10905 in the wild and no public exploit code.
Other vulnerabilities in SailPoint Technologies IdentityIQ
- CVE-2024-2227 IdentityIQ JavaServer Faces File Path Traversal Vulnerability
- CVE-2023-32217 SailPoint IdentityIQ Unsafe use of Reflection Vulnerability
- CVE-2026-12341 SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability
- CVE-2022-46835 SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability
- CVE-2026-5712 IdentityIQ Role Editor Incorrect Authorization Vulnerability
Sources
Also known as GHSA-9jcj-c3px-4jc5.