CVE-2023-46262 - An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server

Back Back to CVE browser

HIGH

An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server

Published Dec 19, 2023

7.5

HIGH

CVSS 3.1

EPSS 82.85%

Description

An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server.

Affected products

Vendor Ivanti Product Avalanche Default
unaffected
Affected
- 6.4.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Ivanti	Avalanche	unaffected	Affected 6.4.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (2)

https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt
Release Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50489
Advisory

Link	Providers	Tags
https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt		Release Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50489		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hackerone

Published Dec 19, 2023

Updated Aug 2, 2024

Reserved Oct 20, 2023

Link CVE-2023-46262

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-46262

Red Hat

No data

ENISA EUVD

Assigner hackerone

Published Dec 19, 2023

Updated Aug 2, 2024

Link EUVD-2023-50489

GitHub

No data