CVE-2024-50318
Published: 12 November 2024
Summary
CVE-2024-50318 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Ivanti Avalanche. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A null pointer dereference vulnerability, tracked as CVE-2024-50318 and assigned CWE-476, affects Ivanti Avalanche versions prior to 6.4.6. The flaw carries a CVSS 3.1 base score of 7.5 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that a network-reachable condition can terminate service availability without requiring authentication or user interaction.
A remote unauthenticated attacker can send specially crafted requests to trigger the dereference, resulting in a denial-of-service condition that disrupts the Avalanche management platform. No privileges or prior access are needed, and the attack can be mounted directly over the network.
The official Ivanti security advisory for the Q4 2024 release states that the issue is resolved by upgrading to Avalanche 6.4.6 or later. Administrators are advised to apply the update promptly as part of the broader set of patches released for multiple CVEs.
The associated EPSS score has remained flat at 0.0785 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44814
Vulnerability details
A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.