CVE-2024-13179
Published: 14 January 2025
Summary
CVE-2024-13179 is a high-severity Path Traversal (CWE-22) vulnerability in Ivanti Avalanche. Its CVSS base score is 7.3 (High).
Operationally, ranked in the top 23.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2024-13179 by identifying, reporting, and applying vendor patches to remediate the path traversal flaw allowing authentication bypass.
Prevents path traversal exploitation in Ivanti Avalanche by validating and restricting inputs at file path processing points to block unauthorized access.
Enforces approved access authorizations to limit the scope and impact of authentication bypass achieved via path traversal.
NVD Description
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.
Deeper analysisAI
CVE-2024-13179 is a path traversal vulnerability (CWE-22) in Ivanti Avalanche versions prior to 6.4.7 that allows a remote unauthenticated attacker to bypass authentication (CWE-288). Published on January 14, 2025, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
A remote unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation enables bypassing authentication, potentially resulting in low-impact confidentiality disclosure, integrity modification, and availability disruption.
Ivanti's security advisory for Avalanche 6.4.7 details multiple CVEs, including this one, and recommends upgrading to version 6.4.7 to mitigate the issues.
Details
- CWE(s)