PT-2024-1727 · Ivanti · Ivanti Avalanche

Jbalanza · Published 2024-01-25 · Updated 2024-01-31 · CVE-2023-41474

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche version 6.3.4.153

Description The issue is related to a Directory Traversal vulnerability in the javax.faces.resource component, which can be exploited by a remote authenticated attacker to obtain sensitive information. This vulnerability is due to incorrect restriction of the directory path name with limited access.

Recommendations For Ivanti Avalanche version 6.3.4.153, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-01433

CVE-2023-41474

Affected Products

Ivanti Avalanche

References · 9

• 🔥 https://github.com/JBalanza/CVE-2023-41474 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-41474 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41474 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01433 · Security Note
• https://twitter.com/CVEnew/status/1750607597156114922 · Twitter Post
• https://t.me/pentestingnews/43171 · Telegram Post
• https://twitter.com/DiscoverPet/status/1752725149541912852 · Twitter Post
• https://vuldb.com/?id.252067 · Note
• https://twitter.com/fletch_ai/status/1752634610331324759 · Twitter Post