SailPoint this week warned that a critical-severity vulnerability in the identity and access management (IAM) platform IdentityIQ could allow attackers to access restricted files.
SailPoint’s IdentityIQ IAM platform provides full lifecycle and compliance management capabilities covering provisioning, access requests, certifications, and segregation of duties.
The critical issue, tracked as CVE-2024-10905, has a CVSS score of 10/10 and is described as an improper access control flaw. The bug is, essentially, a directory traversal flaw that affects all IdentityIQ versions up to patch levels 8.4p2, 8.3p5, and 8.2p8.
“IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allows HTTP access to static content in the IdentityIQ application directory that should be protected,” SailPoint notes in an advisory.
The company says it has released e-fixes for all the affected versions of IdentityIQ that are currently supported, and plans to include the fixes in future patch levels for each release.
SailPoint has provided no additional details on the security defect, but directory traversal vulnerabilities typically allow attackers to manipulate user input to access restricted files and directories, which could lead to data compromise and file modification.
Depending on the files the attacker can access, the successful exploitation of a directory traversal bug could lead to the exfiltration of credentials, personal information, and other types of sensitive data.
While there are no reports of CVE-2024-10905 being exploited in the wild, it is not uncommon for threat actors to start exploiting critical-severity vulnerabilities shortly after their public disclosure, and users are advised to update their IdentityIQ instances as soon as possible.
In May, CISA and the FBI issued a warning on path traversal bugs, urging software developers to eliminate them entirely by adopting a secure-by-design software development lifecycle.
Related: Critical Vulnerability Found in Zabbix Network Monitoring Tool
Related: Critical Flaw in PTC License Server Can Allow Lateral Movement in Industrial Organizations
Related: BadAlloc Flaw Impacts Many Systems Running BlackBerry’s QNX Embedded OS
Related: Flaws in Delta OT Monitoring Product Can Allow Hackers to Hide Destructive Activities
