{"id":"CVE-2024-13180","published":"2025-01-14T16:52:41Z","modified":"2025-01-16T19:01:55Z","title":"Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive…","vendor":"Ivanti","product":"Avalanche","tier":"tail","description":{"text":"Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete fixes from CVE-2024-47011.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.27238,"percentile":0.98049,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs","tags":[]}],"priority":{"score":24.9,"factors":[{"name":"EPSS percentile","points":19.61},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"ivanti","affectedVersions":[{"vendor":"Ivanti","product":"Avalanche","versions":["all versions"]}],"euvd":{"id":"EUVD-2024-51402","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ivanti-avalanche-cve-2024-47011","parents":[{"from":"CVE-2024-47011","to":"CVE-2024-13180","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This CVE addresses incomplete fixes from CVE-2024-47011.","from":"CVE.org","in":"CVE-2024-13180"},{"kind":"similar","provenance":"machine","score":0.66,"basis":"same product + CWE + description similarity"}]}]}}