by Kastro
Paper/Archive/CVE-2024-38652

CVE-2024-38652

Ivanti Avalanche — Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of s…

EPSS 8%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 94.5.945 × 2018.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary file deletion.

Affected

ProductAffectedFixed inSource
Avalanche6.4.4 – < 6.4.46.4.4CNA
avalanche6.3.1 – < 6.4.46.4.4CISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
hackerone (CNA)8.2CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refforums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373