PT-2023-21583 · Avalanche · Avalanche

Published 2023-04-24 · Updated 2023-05-16 · CVE-2023-28126

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Avalanche versions 6.3.x and below

Description An authentication bypass issue exists that could allow an attacker to gain access by exploiting the SetUser method or by exploiting a Race Condition in the authentication message.

Recommendations For Avalanche versions 6.3.x and below, consider disabling the SetUser method until a patch is available to prevent exploitation of the authentication bypass vulnerability. Restrict access to authentication messages to minimize the risk of exploiting the Race Condition. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

CWE-305

Related Identifiers

CVE-2023-28126

ZDI-23-454

Affected Products

Avalanche

References · 7

• https://osv.dev/vulnerability/CVE-2023-28126 · Vendor Advisory
• https://forums.ivanti.com/s/article/ZDI-CAN-17750-Ivanti-Avalanche-EnterpriseServer-GetSettings-Exposed-Dangerous-Method-Authentication-Bypass-Vulnerability?language=en_US · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28126 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-454 · Security Note
• https://t.me/cvenotify/50102 · Telegram Post
• https://t.me/cvenotify/50096 · Telegram Post
• https://t.me/cibsecurity/63707 · Telegram Post