CVE-2024-38652 - Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary file deletion

Back Back to CVE browser

CRITICAL

Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary file deletion

Published Aug 14, 2024

9.1

CRITICAL

CVSS 3.1

EPSS 7.60%

Description

Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary file deletion.

Affected products

Vendor Ivanti Product Avalanche Default
unaffected
- Version
  6.4.4
  Status
  affected
  Constraints
  <6.4.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ivanti

Avalanche

unaffected

Version	Status	Constraints
6.4.4	affected	<6.4.4

Vendor Ivanti Product Avalanche Default
n/a
- Version
  6.3.1
  Status
  affected
  Constraints
  <6.4.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ivanti

Avalanche

n/a

Version	Status	Constraints
6.3.1	affected	<6.4.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37507		Advisory
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373		Vendor Advisory