{"id":"CVE-2024-10905","aliases":["EUVD-2024-33546","GHSA-9jcj-c3px-4jc5"],"status":"published","title":"IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability","description":"IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00948,"percentile":0.61602,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-66"],"published":"2024-12-02T14:49:51Z","modified":"2026-06-17T06:56:40Z","products":[{"vendor":"sailpoint","product":"identityiq"},{"vendor":"sailpoint technologies","product":"identityiq"}],"references":[{"url":"https://www.sailpoint.com/security-advisories/identityiq-improper-access-control-vulnerability-cve-2024-10905","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10905"},{"url":"https://www.sailpoint.com/security-advisories"},{"url":"https://github.com/advisories/GHSA-9jcj-c3px-4jc5"}],"sources":{"cve":[{"id":"CVE-2024-10905","title":"IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability","description":"IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.","status":"published","published":"2024-12-02T14:49:51.199Z","modified":"2025-01-06T17:42:22.215Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-66"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-33546","description":"IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.","status":"published","published":"2024-12-02T14:49:51Z","modified":"2025-01-06T17:42:22Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:25.578405Z"}],"ghsa":[{"id":"GHSA-9jcj-c3px-4jc5","title":"IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels...","description":"IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allows HTTP access to static content in the IdentityIQ application directory that should be protected.","status":"published","published":"2024-12-02T15:31:41Z","modified":"2024-12-04T18:33:40Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-66"],"updated_at":"2026-11-02T14:59:02.702846Z"}],"nvd":[{"id":"CVE-2024-10905","description":"IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.","status":"published","published":"2024-12-02T15:15:10.24Z","modified":"2026-06-17T06:56:40.053Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-66"],"updated_at":"2026-11-02T14:10:38.973941Z"}]}}