PT-2024-6875 · Ivanti · Ivanti Avalanche

Published 2024-04-17 · Updated 2025-11-17 · CVE-2024-47011

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.4.5

Description The issue is a path traversal affecting the Faces Mojarra component within Ivanti Avalanche. This allows a remote, unauthenticated attacker to potentially reveal sensitive information. The vulnerability stems from improper restriction of the path name to an access-restricted directory.

Recommendations Versions prior to 6.4.5 should be updated to version 6.4.5 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-08098

CVE-2024-47011

ZDI-24-1327

Affected Products

Ivanti Avalanche

References · 13

• https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1327 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47011 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47011 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08098 · Security Note
• https://twitter.com/CVEnew/status/1843694402197168491 · Twitter Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-23526 · Note
• https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory?language=en_US · Note
• https://t.me/cvedetector/7384 · Telegram Post
• https://t.me/cvedetector/15307 · Telegram Post
• https://twitter.com/cracbot/status/1845343839814586553 · Twitter Post
• https://t.me/CSIRT_italia/2916 · Telegram Post
• https://t.me/cvenotify/107701 · Telegram Post