PT-2024-26915 · Ivanti · Ivanti Avalanche

Published

2024-08-14

·

Updated

2024-08-15

·

CVE-2024-36136

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Ivanti Avalanche version 6.3.1
Description The issue is caused by an off-by-one error in the WLInfoRailService, allowing a remote unauthenticated attacker to crash the service, resulting in a denial of service. Additionally, improper input validation in the Central Filestore allows a remote authenticated attacker with admin rights to achieve remote code execution.
Recommendations For Ivanti Avalanche version 6.3.1, consider disabling the WLInfoRailService until a patch is available to prevent the service from being crashed by an unauthenticated attacker. As a temporary workaround, restrict access to the Central Filestore to minimize the risk of remote code execution by authenticated attackers with admin rights. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2024-36136

Affected Products

Ivanti Avalanche