CVE-2024-24999
Published: 19 April 2024
Summary
CVE-2024-24999 is a high-severity Path Traversal (CWE-22) vulnerability in Ivanti Avalanche. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-24999 is a path traversal vulnerability, tracked as CWE-22, that affects the web component of Ivanti Avalanche versions prior to 6.4.3. The flaw received a CVSS v3.1 base score of 8.8, reflecting network-accessible attack vectors with low complexity and no required user interaction.
A remote authenticated attacker can leverage the vulnerability to traverse file paths and execute arbitrary commands with SYSTEM-level privileges on the target system. This grants the attacker full control over the affected Avalanche instance, including the ability to read, modify, or delete data and potentially pivot to other systems.
The vendor advisory for Avalanche 6.4.3 describes security hardening measures and explicitly lists the addressed CVEs, confirming that upgrading to version 6.4.3 resolves the path traversal issue. The EPSS score has remained flat at 0.0902 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-22361
Vulnerability details
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.