CVE-2024-23532
Published: 19 April 2024
Summary
CVE-2024-23532 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Ivanti Avalanche. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
An out-of-bounds read vulnerability, tracked as CVE-2024-23532 with CWE-125, exists in the WLAvalancheService component of Ivanti Avalanche versions prior to 6.4.3. The issue received a CVSS 3.1 score of 7.5 and was published on 19 April 2024.
An authenticated remote attacker can trigger the flaw over the network to cause denial of service. Under certain conditions the same access can also result in remote code execution, as reflected in the high impact metrics for confidentiality, integrity, and availability.
Ivanti’s security advisory states that the vulnerability is addressed by upgrading to Avalanche 6.4.3, which includes security hardening changes that resolve this and related CVEs.
The associated EPSS score has remained flat at 0.2081 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21027
Vulnerability details
An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service attacks. In certain conditions this could also lead to remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.