PT-2024-2836 · Ivanti · Ivanti Avalanche

Published

2024-03-18

·

Updated

2024-04-29

·

CVE-2024-24996

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.4.3
Description A Heap overflow vulnerability in the WLInfoRailService component allows an unauthenticated remote attacker to execute arbitrary commands. The vulnerability is related to a heap-based buffer overflow, which can be exploited by a remote attacker to execute arbitrary code on affected installations. No authentication is required to exploit this vulnerability.
Recommendations For versions prior to 6.4.3, update to version 6.4.3 or later to resolve the issue. As a temporary workaround, consider disabling the WLInfoRailService component until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2024-02984
CVE-2024-24996
ZDI-24-386

Affected Products

Ivanti Avalanche