CVE-2024-1714 Access Request for Entitlement Values with Leading/Trailing Whitespace
Authenticated users can bypass entitlement restrictions by requesting values with leading or trailing whitespace in SailPoint IdentityIQ.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-1714?
CVE-2024-1714 is a high-severity vulnerability in SailPoint IdentityIQ, published on 21 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request.
Weakness: CWE-20
Which versions are affected by CVE-2024-1714?
It affects 1 product.
Products include Sailpoint Identityiq.
How do I fix CVE-2024-1714?
No fix has been published for CVE-2024-1714 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-1714 being exploited?
There is no known exploitation of CVE-2024-1714 in the wild and no public exploit code.
Other vulnerabilities in SailPoint IdentityIQ
- CVE-2024-10905 IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability
- CVE-2024-2227 IdentityIQ JavaServer Faces File Path Traversal Vulnerability
- CVE-2023-32217 SailPoint IdentityIQ Unsafe use of Reflection Vulnerability
- CVE-2026-12341 SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability
- CVE-2022-46835 SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability
Sources
Also known as GHSA-x5qv-8w36-gxh4.