A Cross-Site Scripting vulnerability in SailPoint IdentityIQ allows authenticated users to potentially execute arbitrary scripts within a user session.

This vulnerability involves improper neutralization of input during web page generation (CWE-79). Specifically, the application serves non-HTML content via a path that forces a browser to interpret the data as HTML, which allows an authenticated user with low privileges to trigger an XSS attack.

The exploitation of this vulnerability could lead to unauthorized script execution in the context of a victim's session, potentially resulting in session hijacking or the theft of sensitive identity data. With a CVSS score of 7.1, the risk is significant due to the potential for total impact on confidentiality, integrity, and availability if an attacker successfully bypasses security controls.

Immediate Action: Upgrade to the latest patched version of IdentityIQ as specified in the official SailPoint security advisory.

Proactive Monitoring: Review web server and application access logs for unusual URL patterns or requests that attempt to force content type rendering.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and sanitize HTTP responses for malicious script injections or unexpected content-type headers.

Public Exploit Available: No

Given the potential for XSS to compromise administrative or user accounts within the identity management ecosystem, administrators should prioritize applying the vendor-supplied patches. Organizations unable to patch immediately should implement strict WAF rules to filter potentially malicious content-type behaviors and restrict access to sensitive web service endpoints.