Unauthorized Access to Arbitrary Files in Ivanti SmartDeviceServer 6.3.1

CVE-2024-38653

Summary

An XXE (XML External Entity) vulnerability exists in the SmartDeviceServer component of Ivanti Avalanche 6.3.1. This allows a remote unauthenticated attacker to exploit the issue and gain unauthorized access to read arbitrary files stored on the server. This vulnerability poses a risk to the security of sensitive data managed within the Ivanti Avalanche environment, highlighting the importance of immediate patching and risk mitigation strategies.

References