PT-2024-6877 · Ivanti · Ivanti Avalanche

Published 2024-04-17 · Updated 2025-11-17 · CVE-2024-47008

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.4.5

Description A server-side request forgery issue exists in the validateAMCWSConnection function of Ivanti Avalanche. This flaw allows a remote, unauthenticated attacker to disclose sensitive information by exploiting insufficient validation of incoming requests. The vulnerability impacts the ability to protect data handled by the system. The affected API endpoint is not specified. The vulnerable parameter is not specified.

Recommendations Versions prior to 6.4.5 should be updated to version 6.4.5 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2024-08100

CVE-2024-47008

ZDI-24-1324

Affected Products

Ivanti Avalanche

References · 12

• https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47008 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1324 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47008 · Security Note
• https://bdu.fstec.ru/vul/2024-08100 · Security Note
• https://twitter.com/CVEnew/status/1843694405766566019 · Twitter Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-23520 · Note
• https://t.me/cvedetector/7388 · Telegram Post
• https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory?language=en_US · Note
• https://t.me/cvenotify/98269 · Telegram Post
• https://twitter.com/cracbot/status/1845343834940768538 · Twitter Post
• https://t.me/CSIRT_italia/2916 · Telegram Post