CVE-2024-10905

Description

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.

Is your site exposed to CVE-2024-10905?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-66 CWE-66

Affected Products

Vendor	Product	Versions
sailpoint	identityiq	< 8.2
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All
sailpoint	identityiq	All

References

Advisories & Patches

https://www.sailpoint.com/security-advisories/identityiq-improper-access-control-vulnerability-cve-2024-10905

Frequently Asked Questions

What is CVE-2024-10905? +

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected. It has a CVSS v3.1 base score of 10.0 (CRITICAL).

How severe is CVE-2024-10905? +

CVE-2024-10905 has a CVSS v3.1 score of 10.0 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-10905? +

CVE-2024-10905 affects products from sailpoint, specifically: identityiq. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-10905? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-2227 10.0

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in …

CVE-2026-5712 8.0

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a …

CVE-2024-1714 7.1

An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value …

CVE-2024-2228 7.1

This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside …

CVE-2025-10280 7.1

IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including …