PT-2024-8675 · Ivanti · Ivanti Avalanche

Published 2024-08-13 · Updated 2024-09-04 · CVE-2024-38653

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche version 6.3.1

Description The issue is related to an XML External Entity (XXE) flaw in the SmartDeviceServer component of Ivanti Avalanche. This flaw allows a remote unauthenticated attacker to read arbitrary files on the server, potentially disclosing protected information. The vulnerability is associated with incorrect restriction of XML links to external objects.

Recommendations For Ivanti Avalanche version 6.3.1, consider disabling the decodeToMap XML External Entity Processing function as a temporary workaround until a patch is available. Restrict access to the SmartDeviceServer component to minimize the risk of exploitation. Avoid using the vulnerable XML processing functionality in the affected server until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2024-10277

CVE-2024-38653

ZDI-24-1150

Affected Products

Ivanti Avalanche

References · 30

• https://nvd.nist.gov/vuln/detail/CVE-2024-38653 · Security Note
• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1150 · Security Note
• https://bdu.fstec.ru/vul/2024-10277 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38653 · Vendor Advisory
• https://t.me/cvenotify/90457 · Telegram Post
• https://twitter.com/CVEnew/status/1823635378911220013 · Twitter Post
• https://twitter.com/D4mianWayne/status/1828654718446383599 · Twitter Post
• https://t.me/cvenotify/90496 · Telegram Post
• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373?language=en_US · Note
• https://t.me/cvenotify/90533 · Telegram Post
• https://twitter.com/vipr_lab/status/1829501395818414177 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1829342921860305058 · Twitter Post
• https://t.me/cvenotify/90499 · Telegram Post
• https://t.me/cvenotify/90456 · Telegram Post