Medium WID-SEC-2024-3113 5 CVEs

Ivanti Avalanche: Mehrere Schwachstellen

Published Oct 8, 2024 · Updated Oct 8, 2024 · de-DE

Vendor: ivanti Product: Avalanche Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ivanti Avalanche ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.

Product

Ivanti Avalanche ist eine Mobile Device Management Lösung.

Vulnerabilities 5

High 7.5

CVE-2024-47007

A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthent…

ivanti Avalanche Network devices

Oct 8, 2024
High 7.5

CVE-2024-47008 EPSS 47%

Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak s…

ivanti Avalanche Network devices

Oct 8, 2024
High 7.5

CVE-2024-47011 EPSS 56%

Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive info…

ivanti Avalanche Network devices

Oct 8, 2024
High 7.3

CVE-2024-47009

Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authenticati…

ivanti Avalanche Network devices

Oct 8, 2024
High 7.3

CVE-2024-47010 EPSS 38%

Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authenticati…

ivanti Avalanche Network devices

Oct 8, 2024

Revision history

2024-10-08 #1
Initiale Fassung

References

Ivanti Security Advisory vom 2024-10-08
https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory