CVE-2024-10905: fallo crítico en SailPoint Technologies IdentityIQ
IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 10epss 0.9%
IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
SailPoint Technologies · IdentityIQCVEs relacionadas — SailPoint Technologies IdentityIQ
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-12341HIGHSailPoint IdentityIQ Improper Bearer Token Validation VulnerabilityEPSS 0.4%CVE-2026-4857HIGHSailPoint IdentityIQ Debug UI Incorrect AuthorizationEPSS 0.3%CVE-2025-10280HIGHIncorrect Content Type Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-12342CRITICALSailPoint IdentityIQ Improper Form Validation VulnerabilityEPSS 0.2%CVE-2026-5712HIGHIdentityIQ Role Editor Incorrect Authorization VulnerabilityEPSS 0.2%