PT-2018-18702 · Ivanti · Ivanti Avalanche

Published 2018-06-29 · Updated 2020-08-24 · CVE-2018-8901

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions 5.3 through 6.2

Description A local user with database access privileges can read the encrypted passwords for users who authenticate via LDAP to Avalanche services. These passwords are stored in the Avalanche databases. This issue only affects customers who have enabled LDAP authentication in their configuration.

Recommendations For Ivanti Avalanche versions 5.3 through 6.2, consider disabling LDAP authentication as a temporary workaround until a patch is available. Restrict access to the Avalanche databases to minimize the risk of exploitation. Avoid using LDAP authentication in the affected Avalanche services until the issue is resolved.

Fix

Related Identifiers

CVE-2018-8901

Affected Products

Ivanti Avalanche

References · 3

• https://osv.dev/vulnerability/CVE-2018-8901 · Vendor Advisory
• https://community.ivanti.com/docs/DOC-68406 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8901 · Security Note