CVE-2021-30497: Path Traversal

Published Apr 6, 2022

Updated

Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive information via the C:/Windows/system32/config/system.sav value.

Affected Software

1 affected component

Ivanti Avalanche Windows=6.3.2

Remediation

Patch Available

https://forums.ivanti.com/s/article/Security-Alert-CVE-2021-30497-Directory-Traversal-Vulnerability?language=en_US

Event History

Apr 6, 2022

CVE Published

via MITRE·01:22 AM

Data Sourced

via MITRE·01:22 AM

Description

Frequently Asked Questions

What is the severity of CVE-2021-30497?

The severity of CVE-2021-30497 is high with a CVSS score of 7.5.

How does Ivanti Avalanche (Premise) 6.3.2 allow remote unauthenticated users to read arbitrary files?

Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files through Absolute Path Traversal.

What is the affected software and version of CVE-2021-30497?

The affected software is Ivanti Avalanche version 6.3.2.

How can I fix the Directory Traversal vulnerability in Ivanti Avalanche (Premise) 6.3.2?

To fix the Directory Traversal vulnerability in Ivanti Avalanche (Premise) 6.3.2, upgrade to a patched version provided by Ivanti.

Is there any further information available on CVE-2021-30497?

Yes, you can find further information on CVE-2021-30497 in the references provided: [link1], [link2], [link3].