SB2024081432 - Multiple vulnerabilities in Ivanti Avalanche

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024081432

SB2024081432 - Multiple vulnerabilities in Ivanti Avalanche

Published: August 14, 2024 Updated: December 17, 2025

Security Bulletin ID SB2024081432
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 40% Medium 40% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2024-38652)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the skin management component. A remote attacker can send a specially crafted HTTP request and delete arbitrary files on the system.


2) Input validation error (CVE-ID: CVE-2024-37373)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in the Central Filestore. A remote administrator can pass specially crafted input to the application and execute arbitrary code on the target system.


3) NULL pointer dereference (CVE-ID: CVE-2024-37399)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in WLAvalancheService. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.


4) Off-by-one (CVE-ID: CVE-2024-36136)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error in WLInfoRailService. A remote attacker can trigger an off-by-one error and cause a denial of service condition on the target system.


5) XML External Entity injection (CVE-ID: CVE-2024-38653)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Amber


The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input in SmartDeviceServer. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.


Remediation

Install update from vendor's website.

References