Critical SailPoint IdentityIQ Vulnerability Exposes Files to Unauthorized Access

Share:

A critical security vulnerability has been disclosed in SailPoint’s IdentityIQ identity and access management (IAM) software that allows unauthorized access to content stored within the application directory.

The flaw, tracked as CVE-2024-10905, has a CVSS score of 10.0, indicating maximum severity. It affects IdentityIQ versions 8.2. 8.3, 8.4, and other previous versions.

IdentityIQ “allows HTTP access to static content in the IdentityIQ application directory that should be protected,” according to a description of the flaw on NIST’s National Vulnerability Database (NVD).

The vulnerability has been characterized as a case of improper handling of file names that identify virtual resources (CWE-66), which could be abused to read otherwise inaccessible files.

In an alert of its own, SailPoint said it has “released e-fixes for each impacted and supported version of IdentityIQ.” The exact list of versions impacted by CVE-2024-10905 is mentioned below –

  • 8.4 and all 8.4 patch levels prior to 8.4p2
  • 8.3 and all 8.3 patch levels prior to 8.3p5
  • 8.2 and all 8.2 patch levels prior to 8.2p8, and
  • All prior versions

The Hacker News has reached out to SailPoint for comment prior to the publication of this story and will update the piece if we hear back from the company.

Update

In response to our queries, SailPoint CISO Rex Booth shared following statement with The Hacker News –

As part of our continued commitment to transparency and security, on Monday December 2, SailPoint issued a security advisory for its Identity IQ product which was assigned CVE-2024-10905. A fix has already been released, and we’ve provided customers with guidance on how to apply it.

Publishing CVEs is a voluntary practice across the industry that demonstrates dedication to security and transparency. At SailPoint, we invest in secure development practices and strive to catch vulnerabilities prior to software release, but, as with all software, new vulnerabilities can emerge as attacker tactics and detection capabilities evolve. For this reason, we continually test our products in all stages of the development lifecycle to minimize risk to our customers. Finding and remediating vulnerabilities is a symptom of a mature security program, and a company dedicated to safeguarding the cyber ecosystem.

Source

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
9:49 pm, Jun 22, 2025
weather icon 20°C
L: 19° | H: 21°
few clouds
Humidity: 69 %
Pressure: 1011 mb
Wind: 15 mph SW
Wind Gust: 26 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 20%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:43 am
Sunset: 9:21 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
19° | 21°°C 0 mm 0% 10 mph 68 % 1011 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
15° | 23°°C 0.66 mm 66% 14 mph 78 % 1016 mb 0 mm/h
Tue Jun 24 10:00 pm
weather icon
13° | 24°°C 0.2 mm 20% 14 mph 81 % 1016 mb 0 mm/h
Wed Jun 25 10:00 pm
weather icon
16° | 28°°C 0 mm 0% 11 mph 88 % 1014 mb 0 mm/h
Thu Jun 26 10:00 pm
weather icon
17° | 25°°C 1 mm 100% 15 mph 84 % 1018 mb 0 mm/h
Today 10:00 pm
weather icon
18° | 20°°C 0 mm 0% 10 mph 68 % 1011 mb 0 mm/h
Tomorrow 1:00 am
weather icon
19° | 20°°C 0 mm 0% 13 mph 71 % 1011 mb 0 mm/h
Tomorrow 4:00 am
weather icon
17° | 18°°C 0.66 mm 66% 14 mph 78 % 1011 mb 0 mm/h
Tomorrow 7:00 am
weather icon
15° | 15°°C 0.2 mm 20% 13 mph 64 % 1013 mb 0 mm/h
Tomorrow 10:00 am
weather icon
18° | 18°°C 0 mm 0% 13 mph 45 % 1014 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
20° | 20°°C 0 mm 0% 13 mph 32 % 1014 mb 0 mm/h
Tomorrow 4:00 pm
weather icon
23° | 23°°C 0 mm 0% 14 mph 30 % 1014 mb 0 mm/h
Tomorrow 7:00 pm
weather icon
21° | 21°°C 0 mm 0% 14 mph 40 % 1015 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€85,943.03
-3.54%
Ethereum(ETH)
€1,877.56
-9.86%
Tether(USDT)
€0.87
0.00%
XRP(XRP)
€1.69
-6.51%
Solana(SOL)
€111.35
-7.21%
USDC(USDC)
€0.87
0.00%
Dogecoin(DOGE)
€0.126543
-7.86%
Shiba Inu(SHIB)
€0.000009
-6.84%
Pepe(PEPE)
€0.000008
-10.33%
Peanut the Squirrel(PNUT)
€0.218233
13.10%
Scroll to Top