PT-2023-23878 · Ivanti · Ivanti Avalanche

Published 2023-08-10 · Updated 2023-11-03 · CVE-2023-32567

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.4.1.236

Description The issue concerns XML External Entity Processing in the decodeToMap function of Ivanti Avalanche, which can lead to information disclosure.

Recommendations For versions prior to 6.4.1.236, update to version 6.4.1.236 to resolve the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-32567

ZDI-23-1167

Affected Products

Ivanti Avalanche

References · 5

• https://osv.dev/vulnerability/CVE-2023-32567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32567 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1167 · Security Note
• https://download.wavelink.com/Files/avalanche_v6.4.1.236_release_notes.txt · Note
• https://twitter.com/VulmonFeeds/status/1689738138992640000 · Twitter Post