{"id":"CVE-2023-46262","published":"2023-12-19T15:43:26Z","modified":"2024-08-02T20:37:40Z","title":"An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF)…","vendor":"Ivanti","product":"Avalanche","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"Avalanche","versions":[">= 6.4.1, <= 6.4.1"]}],"description":{"text":"An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server.","provenance":"source","from":"CVE.org"},"summary":{"text":"A server-side request forgery flaw exists in the web interface of Ivanti Avalanche Remote Control server, the Avalanche product's remote control server component. An unauthenticated attacker with network access to the server can send a specially crafted web request to make the server issue requests to destinations of the attacker's choosing, with no user interaction or configuration prerequisites beyond reaching the service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:30Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.82846,"percentile":0.99669,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-50489","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50489","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-12-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-46262","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9967"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}