Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information
Ivanti · Avalanche
Ivanti Avalanche has a path traversal flaw (CWE: Improper Limitation of a Pathname to a Restricted Directory) affecting versions before 6.4.5. A remote attacker with no authentication and no required user interaction can exploit it over the network to leak sensitive information.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 8 Oct 2024. No public exploit code or confirmed exploitation is recorded.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
A fix was bypassed or incomplete once over 3 months.
Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.
- This CVECVE-2024-47011Path Traversal in Ivanti Avalanche before version 6.4.5 allows a…8 Oct 2024
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
This CVE addresses incomplete fixes from CVE-2024-47011.
- Similar weakness in the same product (machine-matched)same product + CWE + description similarity
- Stated in the CVE text
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.