PT-2023-8279 · Ivanti · Ivanti Avalanche

CVE-2023-46265 · Publicado 2023-12-12 · Atualizado 2024-09-17

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche (affected versions not specified)

Description The issue is related to an XML External Entity (XXE) vulnerability in the Smart Device Server, which could allow an unauthenticated attacker to leak data or perform a Server-Side Request Forgery (SSRF). This vulnerability is also associated with a buffer overflow in the decoding method of the mobile device management system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2024-00359

CVE-2023-46265

ZDI-24-054

Produtos afetados

Ivanti Avalanche

Referências · 8

• https://t.me/cvenotify/64988 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-46265 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-24-054 · Nota de Segurança
• https://twitter.com/CVEnew/status/1737138855441309943 · Publicação no Twitter
• https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt · Nota
• https://osv.dev/vulnerability/CVE-2023-46265 · Aviso do Fabricante
• https://forums.ivanti.com/s/article/Avalanche-6-4-2-Security-Hardening-and-CVEs-addressed?language=en_US · Nota
• https://bdu.fstec.ru/vul/2024-00359 · Nota de Segurança