CVE-2024-23535
Published: 19 April 2024
Summary
CVE-2024-23535 is a high-severity Path Traversal (CWE-22) vulnerability in Ivanti Avalanche. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-23535 is a path traversal vulnerability (CWE-22) affecting the web component of Ivanti Avalanche versions prior to 6.4.3. The flaw carries a CVSS 3.1 base score of 8.8 and permits remote attackers to traverse file paths and ultimately execute arbitrary commands with SYSTEM-level privileges on the affected server.
A remote authenticated attacker with network access can exploit the issue without user interaction or special conditions beyond low attack complexity. Successful exploitation grants full read, write, and execute capabilities on the target system, resulting in complete loss of confidentiality, integrity, and availability.
Ivanti’s security hardening bulletin for Avalanche 6.4.3 states that the release addresses this and other CVEs; administrators are therefore advised to upgrade to version 6.4.3 or later. The associated EPSS score of 0.6178 has remained flat since disclosure, indicating sustained but not newly emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21030
Vulnerability details
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.