Description
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010.
Published: 2025-01-14
Score: 7.3 High
EPSS: 33.2% Moderate
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 16 Jan 2025 22:30:00 +0100

Type Values Removed Values Added
First Time appeared Ivanti
Ivanti avalanche
CPEs cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*
Vendors & Products Ivanti
Ivanti avalanche

Thu, 16 Jan 2025 20:15:00 +0100

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jan 2025 18:00:00 +0100

Type Values Removed Values Added
Description Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010.
Weaknesses CWE-22
CWE-288
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Ivanti Avalanche
cve-icon MITRE

Status: PUBLISHED

Assigner: ivanti

Published:

Updated: 2025-01-16T19:06:15.676Z

Reserved: 2025-01-07T18:10:32.639Z

Link: CVE-2024-13181

cve-icon Vulnrichment

Updated: 2025-01-16T19:06:04.040Z

cve-icon NVD

Status : Analyzed

Published: 2025-01-14T17:15:14.433

Modified: 2026-06-17T07:01:23.990

Link: CVE-2024-13181

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-288

    Authentication Bypass Using an Alternate Path or Channel