PT-2024-2926 · Ivanti · Ivanti Avalanche

Published 2024-03-18 · Updated 2025-06-03 · CVE-2024-24992

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.4.3

Description The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability allows a remote authenticated attacker to execute arbitrary commands as SYSTEM due to incorrect restriction of the directory path name with limited access.

Recommendations For versions prior to 6.4.3, update to version 6.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable web component until a patch is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-03091

CVE-2024-24992

ZDI-24-382

Affected Products

Ivanti Avalanche

References · 12

• https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-382 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-24992 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24992 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03091 · Security Note
• https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US&languageenUS= · Note
• https://twitter.com/rene_helmke/status/1787123987241206095 · Twitter Post
• https://t.me/csirt_italia/2462 · Telegram Post
• https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US&languageenUS= · Note
• https://twitter.com/CVEnew/status/1781153894053380197 · Twitter Post
• https://t.me/cvenotify/106485 · Telegram Post
• zdi-can-22854https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US · Note