CVE-2024-29848

State: Published
Severity: 7.2 High
Published: May 31, 2024
Updated: Sep 19, 2024
Reserved: Mar 21, 2024

Description

An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM.

Scores

CVSS	Score	Vector	Source
3.0	7.2 High	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	hackerone

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
AvalancheIvanti	6.4.3 through 6.4.3Affected

References

https://forums.ivanti.com/s/article/Security-Advisory-May-2024
https://forums.ivanti.com/s/article/Avalanche-6-4-3-602-additional-security-hardening-and-CVE-fixed?language=en_USvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.