CVE-2024-24994
Published: 19 April 2024
Summary
CVE-2024-24994 is a high-severity Path Traversal (CWE-22) vulnerability in Ivanti Avalanche. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-24994 is a path traversal vulnerability, tracked as CWE-22, that affects the web component of Ivanti Avalanche versions prior to 6.4.3. The flaw carries a CVSS 3.1 base score of 8.8 and permits remote code execution with elevated privileges on the underlying host.
A remote attacker who already possesses valid credentials can leverage the vulnerability over the network to run arbitrary commands as the SYSTEM account, resulting in full control of confidentiality, integrity, and availability on the affected system.
Ivanti has released Avalanche 6.4.3 to resolve the issue as part of broader security hardening measures; the corresponding advisory directs customers to upgrade and apply the associated patches.
The EPSS score for this CVE currently stands at 0.4821 with no material change from its recorded peak, indicating sustained but not newly emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-22356
Vulnerability details
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.