CVE-2024-38653highobserved exploitationCWE-611

CVE-2024-38653: high-severity vulnerability in Ivanti Avalanche

Published

Follow this CVE+ Monitor Avalanche

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

80Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.2epss 92%
from disclosure to weapon
Published on NVDAug 14
VulnCheck+120d
In short

A flaw in Ivanti Avalanche 6.3.1 allows attackers to read any file on the server by sending specially crafted XML requests, without needing to log in. This can expose sensitive data like configuration files or credentials.

Technical detail

XXE (XML External Entity) injection vulnerability in SmartDeviceServer component allows unauthenticated remote attackers to read arbitrary files via malicious XML payloads. Exploitation requires network access to the affected endpoint and no authentication; successful exploitation results in information disclosure of sensitive server files.

Summary generated and translated by AI from the official description.
XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected products
Ivanti · Avalanche
Related CVEs — Ivanti Avalanche

In the same product, most dangerous first.

CVE-2023-32560HIGHCVE-2023-32560EPSS 99.4%CVE-2021-22962HIGHCVE-2021-22962EPSS 91.0%CVE-2023-46264HIGHCVE-2023-46264EPSS 90.2%CVE-2023-32563HIGHCVE-2023-32563EPSS 89.1%CVE-2022-36974CRITICALCVE-2022-36974EPSS 84.5%CVE-2022-36981HIGHCVE-2022-36981EPSS 83.4%