CVE-2025-10280 (GCVE-0-2025-10280)
Vulnerability from cvelistv5
Published
2025-11-03 16:35
Modified
2025-11-06 20:45
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Summary
IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS).
References
Impacted products
Vendor Product Version
SailPoint Technologies IdentityIQ Version: 8.5   ≤
Version: 8.4   ≤
Version: 8.3   ≤ 8.3p5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-03T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-04T04:55:16.187Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "IdentityIQ",
          "vendor": "SailPoint Technologies",
          "versions": [
            {
              "status": "affected",
              "version": "8.5",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4p4",
              "status": "affected",
              "version": "8.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.3p5",
              "status": "affected",
              "version": "8.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-11-03T16:35:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIdentityIQ\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and\nall 8.3 patch levels including 8.3p5, and all prior versions allows some\nIdentityIQ web services that provide non-HTML content to be accessed via a URL\npath that will set the Content-Type to HTML allowing a requesting browser to\ninterpret content not properly escaped to prevent Cross-Site Scripting (XSS). \u003c/p\u003e"
            }
          ],
          "value": "IdentityIQ\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and\nall 8.3 patch levels including 8.3p5, and all prior versions allows some\nIdentityIQ web services that provide non-HTML content to be accessed via a URL\npath that will set the Content-Type to HTML allowing a requesting browser to\ninterpret content not properly escaped to prevent Cross-Site Scripting (XSS)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-06T20:45:31.741Z",
        "orgId": "2cfc7547-56a0-4049-8b52-c3078e8a8719",
        "shortName": "SailPoint"
      },
      "references": [
        {
          "url": "https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect Content Type Cross-Site Scripting Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2cfc7547-56a0-4049-8b52-c3078e8a8719",
    "assignerShortName": "SailPoint",
    "cveId": "CVE-2025-10280",
    "datePublished": "2025-11-03T16:35:56.241Z",
    "dateReserved": "2025-09-11T16:02:56.954Z",
    "dateUpdated": "2025-11-06T20:45:31.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-10280\",\"sourceIdentifier\":\"psirt@sailpoint.com\",\"published\":\"2025-11-03T17:15:32.527\",\"lastModified\":\"2025-11-12T14:49:56.593\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IdentityIQ\\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and\\nall 8.3 patch levels including 8.3p5, and all prior versions allows some\\nIdentityIQ web services that provide non-HTML content to be accessed via a URL\\npath that will set the Content-Type to HTML allowing a requesting browser to\\ninterpret content not properly escaped to prevent Cross-Site Scripting (XSS).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@sailpoint.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"psirt@sailpoint.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.3\",\"matchCriteriaId\":\"B7992F80-093D-4277-9AA8-5438ABFBF83B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"1173CC53-CBE5-450C-96BF-8583D1B3D185\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C0F5E55-5D33-425F-9DA7-49FE66CD84C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:8.3:patch2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A2FD228-E6DB-49E3-BE3E-1BF9B0434FC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:8.3:patch4:*:*:*:*:*:*\",\"matchCriteriaId\":\"0652D99D-DC1E-4E22-8E7D-AE080494C50B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:8.3:patch5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7964011-B0F1-4F07-8C14-6EEA0B421F80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:8.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BC4F08D-A3FB-41F6-8EFD-6F34FBC0F75F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:8.4:patch1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4ECFADA6-BB7B-4228-9434-B92B2FF21481\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:8.4:patch2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A39B1317-37C0-49DA-9207-7B7CBE6EC190\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sailpoint:identityiq:8.5:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"01FF7480-9CBA-4283-994C-B2586C2F5F54\"}]}]}],\"references\":[{\"url\":\"https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280\",\"source\":\"psirt@sailpoint.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-10280\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-03T20:50:31.836294Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-11-03T20:50:35.558Z\"}}], \"cna\": {\"title\": \"Incorrect Content Type Cross-Site Scripting Vulnerability\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63 Cross-Site Scripting (XSS)\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SailPoint Technologies\", \"product\": \"IdentityIQ\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.4\", \"lessThan\": \"8.4p4\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.3p5\"}], \"defaultStatus\": \"affected\"}], \"datePublic\": \"2025-11-03T16:35:00.000Z\", \"references\": [{\"url\": \"https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IdentityIQ\\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and\\nall 8.3 patch levels including 8.3p5, and all prior versions allows some\\nIdentityIQ web services that provide non-HTML content to be accessed via a URL\\npath that will set the Content-Type to HTML allowing a requesting browser to\\ninterpret content not properly escaped to prevent Cross-Site Scripting (XSS).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIdentityIQ\\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and\\nall 8.3 patch levels including 8.3p5, and all prior versions allows some\\nIdentityIQ web services that provide non-HTML content to be accessed via a URL\\npath that will set the Content-Type to HTML allowing a requesting browser to\\ninterpret content not properly escaped to prevent Cross-Site Scripting (XSS). \u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"2cfc7547-56a0-4049-8b52-c3078e8a8719\", \"shortName\": \"SailPoint\", \"dateUpdated\": \"2025-11-06T20:45:31.741Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-10280\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-06T20:45:31.741Z\", \"dateReserved\": \"2025-09-11T16:02:56.954Z\", \"assignerOrgId\": \"2cfc7547-56a0-4049-8b52-c3078e8a8719\", \"datePublished\": \"2025-11-03T16:35:56.241Z\", \"assignerShortName\": \"SailPoint\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.