CVE-2024-10905
IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 10EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
02 Dec 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
SailPoint Technologies · IdentityIQ