What’s Vulnerable › Vulnerabilities

CVE-2024-3317: SailPoint Identity Security Cloud Improper Access Control

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-15 · updated 2026-06-17
• Weakness: CWE-1284

Description

An improper access control was identified in the Identity Security Cloud (ISC) message server API that allowed an authenticated user to exfiltrate job processing metadata (opaque messageIDs, work queue depth and counts) for other tenants.

Affected products

• SailPoint Identity Security Cloud: all versions

References

• https://www.sailpoint.com/security-advisories/
• https://www.sailpoint.com/security-advisories/

Get alerted when CVE-2024-3317 or the next vulnerability affects your stack