PT-2018-18702 · Ivanti · Ivanti Avalanche

Publicado 2018-06-29 · Atualizado 2020-08-24 · CVE-2018-8901

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions 5.3 through 6.2

Description A local user with database access privileges can read the encrypted passwords for users who authenticate via LDAP to Avalanche services. These passwords are stored in the Avalanche databases. This issue only affects customers who have enabled LDAP authentication in their configuration.

Recommendations For Ivanti Avalanche versions 5.3 through 6.2, consider disabling LDAP authentication as a temporary workaround until a patch is available. Restrict access to the Avalanche databases to minimize the risk of exploitation. Avoid using LDAP authentication in the affected Avalanche services until the issue is resolved.

Correção

Identificadores relacionados

CVE-2018-8901

Produtos afetados

Ivanti Avalanche

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-8901 · Aviso do Fabricante
• https://community.ivanti.com/docs/DOC-68406 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8901 · Nota de Segurança