CVE-2023-32563
Published: 10 August 2023
Summary
CVE-2023-32563 is a critical-severity Path Traversal (CWE-22) vulnerability in Ivanti Avalanche. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-32563 is a path traversal vulnerability (CWE-22) affecting the RemoteControl server component of Ivanti Avalanche. The flaw carries a CVSS 3.1 score of 9.8 and permits unauthenticated remote code execution when an attacker supplies crafted input that traverses directories on the server.
An unauthenticated attacker with network access can exploit the issue without user interaction or credentials, resulting in full compromise of confidentiality, integrity, and availability on the affected system. The attack vector is rated as network-accessible with low complexity.
Ivanti’s advisory states that the vulnerability is resolved in Avalanche 6.4.1; administrators are advised to apply the update to eliminate the RemoteControl server exposure.
The associated EPSS score has reached a peak of 0.9336 and currently sits at 0.9301, indicating sustained and substantial exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-36807
Vulnerability details
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.