Remote Code Execution Vulnerability in Ivanti Avalanche 6.3.1
CVE-2024-37373

7.2HIGH

Key Information:

Vendor

Ivanti
Status
Avalanche
Vendor
CVE Published:
14 August 2024

What is CVE-2024-37373?

A significant vulnerability exists in Ivanti Avalanche versions 6.3.1 and 6.4.4, where improper input validation in the Central Filestore can be exploited by a remote authenticated attacker with administrative rights. This flaw potentially allows the attacker to execute arbitrary code remotely, posing a major threat to system integrity and data safety. Organizations using affected versions should prioritize patching and review their security measures to mitigate this vulnerability.

Affected Version(s)

Avalanche 6.4.4

References

https://forums.ivanti.com/s/article/Security-Advisory-Iva...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.