Lucene search
HistoryMay 15, 2024 - 4:15 p.m.
CVE-2024-3317
improper access control
identity security cloud
api
authenticated user
exfiltrate
processing metadata
other tenants
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
9.0%
An improper access control was identified in the Identity Security Cloud (ISC) message server API that allowed an authenticated user to exfiltrate job processing metadata (opaque messageIDs, work queue depth and counts) for other tenants.
References
Related
cvelist
cvelist
CVE-2024-3317 SailPoint Identity Security Cloud Improper Access Control
2024-05-15 15:55:07
cve
cve
CVE-2024-3317
2024-05-15 16:15:10
vulnrichment
vulnrichment
CVE-2024-3317 SailPoint Identity Security Cloud Improper Access Control
2024-05-15 15:55:07
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
9.0%
Related for NVD:CVE-2024-3317