CVE-2021-30497: Improper Limitation of a Pathname to a Restricted Directory

Ivanti Avalanche Premise 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive...

PT-2022-10018

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche Premise version 6.3.2 Description The issue allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. This is due to the imageFilePath parameter not being verified to be within the scope of the...