CVE-2025-10280
Full vulnerability record from the local CVENow database.
Description
IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS).
Severity
MEDIUM
CVSS score
6.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-11-03 17:15:32.527000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-10280",
"sourceIdentifier": "[email protected]",
"published": "2025-11-03T17:15:32.527",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IdentityIQ\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and\nall 8.3 patch levels including 8.3p5, and all prior versions allows some\nIdentityIQ web services that provide non-HTML content to be accessed via a URL\npath that will set the Content-Type to HTML allowing a requesting browser to\ninterpret content not properly escaped to prevent Cross-Site Scripting (XSS)."
},
{
"lang": "es",
"value": "IdentityIQ 8.5, IdentityIQ 8.4 y todos los niveles de parche 8.4, versiones anteriores a 8.4p4, IdentityIQ 8.3 y todos los niveles de parche 8.3, incluyendo 8.3p5, y todas las versiones anteriores permiten que algunos servicios web de IdentityIQ que proporcionan contenido no-HTML sean accedidos a través de una ruta URL que establecerá el Content-Type a HTML, permitiendo a un navegador solicitante interpretar contenido no correctamente escapado para prevenir Cross-Site Scripting (XSS)."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "SailPoint Technologies",
"product": "IdentityIQ",
"defaultStatus": "affected",
"versions": [
{
"version": "8.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.4",
"lessThan": "8.4p4",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.3",
"lessThanOrEqual": "8.3p5",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-11-04T04:55:16.675765Z",
"id": "CVE-2025-10280",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.3",
"matchCriteriaId": "B7992F80-093D-4277-9AA8-5438ABFBF83B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:*",
"matchCriteriaId": "1173CC53-CBE5-450C-96BF-8583D1B3D185"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:*",
"matchCriteriaId": "2C0F5E55-5D33-425F-9DA7-49FE66CD84C4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch2:*:*:*:*:*:*",
"matchCriteriaId": "1A2FD228-E6DB-49E3-BE3E-1BF9B0434FC0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch4:*:*:*:*:*:*",
"matchCriteriaId": "0652D99D-DC1E-4E22-8E7D-AE080494C50B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.3:patch5:*:*:*:*:*:*",
"matchCriteriaId": "D7964011-B0F1-4F07-8C14-6EEA0B421F80"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:-:*:*:*:*:*:*",
"matchCriteriaId": "4BC4F08D-A3FB-41F6-8EFD-6F34FBC0F75F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch1:*:*:*:*:*:*",
"matchCriteriaId": "4ECFADA6-BB7B-4228-9434-B92B2FF21481"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.4:patch2:*:*:*:*:*:*",
"matchCriteriaId": "A39B1317-37C0-49DA-9207-7B7CBE6EC190"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sailpoint:identityiq:8.5:-:*:*:*:*:*:*",
"matchCriteriaId": "01FF7480-9CBA-4283-994C-B2586C2F5F54"
}
]
}
]
}
],
"references": [
{
"url": "https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}