{"id":"CVE-2023-46263","published":"2023-12-19T15:43:26Z","modified":"2024-08-02T20:37:40Z","title":"An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that…","vendor":"Ivanti","product":"Avalanche","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"Avalanche","versions":[">= 6.4.1, <= 6.4.1"]}],"description":{"text":"An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution.","provenance":"source","from":"CVE.org"},"summary":{"text":"Ivanti Avalanche contains an unrestricted file upload vulnerability in its versions 6.4.1 and below, where the upload handling does not restrict dangerous file types. An attacker who can reach the product over the network and holds privileged credentials on it can use this flaw to achieve remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:04Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.81884,"percentile":0.99648,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Zero Day Initiative. - CVE-2023-36049: Microsoft .NET CRLF Injection Arbitrary File Write/Deletion Vulnerability","url":"https://otx.alienvault.com/pulse/65e98f23da70e605c92ed98f","created":"2024-03-07"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txt","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-50490","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50490","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-12-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-46263","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9965"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}