Lucene search
HistoryAug 14, 2024 - 3:15 a.m.
CVE-2024-38653
xxe
smartdeviceserver
ivanti avalanche 6.3.1
remote unauthenticated attacker
read arbitrary files
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.007
Percentile
80.6%
XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.
Affected configurations
Node
ivantiavalancheMatch6.3.1premise
ORivantiavalancheMatch6.3.1.1507premise
ORivantiavalancheMatch6.3.2
ORivantiavalancheMatch6.3.2windows
ORivantiavalancheMatch6.3.2premise
ORivantiavalancheMatch6.3.2.3490
ORivantiavalancheMatch6.3.2.3490premise
ORivantiavalancheMatch6.3.3
ORivantiavalancheMatch6.3.3premise
ORivantiavalancheMatch6.3.3.101
ORivantiavalancheMatch6.3.3.101premise
ORivantiavalancheMatch6.3.4
ORivantiavalancheMatch6.3.4premise
ORivantiavalancheMatch6.3.4.153premise
ORivantiavalancheMatch6.4.0
ORivantiavalancheMatch6.4.1
ORivantiavalancheMatch6.4.1premise
ORivantiavalancheMatch6.4.1.207premise
ORivantiavalancheMatch6.4.1.236premise
ORivantiavalancheMatch6.4.2premise
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ivanti | avalanche | 6.3.1 | cpe:2.3:a:ivanti:avalanche:6.3.1:*:*:*:premise:*:*:* |
| ivanti | avalanche | 6.3.1.1507 | cpe:2.3:a:ivanti:avalanche:6.3.1.1507:*:*:*:premise:*:*:* |
| ivanti | avalanche | 6.3.2 | cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:*:*:* |
| ivanti | avalanche | 6.3.2 | cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:windows:*:* |
| ivanti | avalanche | 6.3.2 | cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:premise:*:*:* |
| ivanti | avalanche | 6.3.2.3490 | cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:*:*:*:* |
| ivanti | avalanche | 6.3.2.3490 | cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:premise:*:*:* |
| ivanti | avalanche | 6.3.3 | cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:*:*:*:* |
| ivanti | avalanche | 6.3.3 | cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:premise:*:*:* |
| ivanti | avalanche | 6.3.3.101 | cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:*:*:*:* |
Related
vulnrichment
vulnrichment
CVE-2024-38653
2024-08-14 02:38:00
cvelist
cvelist
CVE-2024-38653
2024-08-14 02:38:00
cve
cve
CVE-2024-38653
2024-08-14 03:15:05
nessus
nessus
Ivanti Avalanche < 6.4.4 Multiple Vulnerabilities
2024-08-23 00:00:00
thn
thn
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.007
Percentile
80.6%
Related for NVD:CVE-2024-38653