CVE-2024-50317
Published: 12 November 2024
Summary
CVE-2024-50317 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Ivanti Avalanche. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A null pointer dereference vulnerability, tracked as CVE-2024-50317 and mapped to CWE-476, affects Ivanti Avalanche versions prior to 6.4.6. The flaw carries a CVSS v3.1 base score of 7.5 under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and permits remote unauthenticated attackers to trigger a denial of service by supplying input that the application fails to validate before dereferencing.
An attacker with network access can send crafted requests to an exposed Ivanti Avalanche server, causing the process to crash and interrupting service availability without any requirement for credentials or user interaction.
The vendor advisory published by Ivanti directs customers to upgrade to Avalanche 6.4.6 or later as the primary mitigation for this issue and the other CVEs addressed in the same Q4 2024 release.
EPSS for the CVE remains flat at 0.0785 with no material post-disclosure rise observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44813
Vulnerability details
A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.