High WID-SEC-2024-1846 5 CVEs

Ivanti Avalanche: Mehrere Schwachstellen

Published Aug 13, 2024 · Updated Aug 13, 2024 · de-DE

Vendor: ivanti Product: Avalanche Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Ivanti Avalanche ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen und vertrauliche Informationen preiszugeben.

Product

Ivanti Avalanche ist eine Mobile Device Management Lösung.

Vulnerabilities 5

High 8.2

CVE-2024-38652

Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to a…

ivanti Avalanche Network devices

Aug 14, 2024
High 8.2

CVE-2024-38653 Scanner template EPSS 92%

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on …

ivanti Avalanche Network devices

Aug 14, 2024
High 7.5

CVE-2024-36136

An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash th…

ivanti Avalanche Network devices

Aug 14, 2024
High 7.5

CVE-2024-37399 EPSS 28%

A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to …

ivanti Avalanche Network devices

Aug 14, 2024
High 7.2

CVE-2024-37373

Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker wit…

ivanti Avalanche Network devices

Aug 14, 2024

Revision history

2024-08-13 #1
Initiale Fassung

References

Ivanti Security Advisory vom 2024-08-13
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373