CVE-2024-38653: XEE
Published Aug 14, 2024
·Updated
XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.
Affected Software
20 affected components
Ivanti Avalanche=6.3.1
Ivanti Avalanche=6.3.1.1507
Ivanti Avalanche=6.3.2
Ivanti Avalanche Windows=6.3.2
Ivanti Avalanche=6.3.2
Ivanti Avalanche=6.3.2.3490
Ivanti Avalanche=6.3.2.3490
Ivanti Avalanche=6.3.3
Ivanti Avalanche=6.3.3
Ivanti Avalanche=6.3.3.101
Ivanti Avalanche=6.3.3.101
Ivanti Avalanche=6.3.4
Ivanti Avalanche=6.3.4
Ivanti Avalanche=6.3.4.153
Ivanti Avalanche=6.4.0
Ivanti Avalanche=6.4.1
Ivanti Avalanche=6.4.1
Ivanti Avalanche=6.4.1.207
Ivanti Avalanche=6.4.1.236
Ivanti Avalanche=6.4.2
Event History
Aug 14, 2024
CVE Published
via MITRE·02:38 AM
Data Sourced
via MITRE·02:38 AM
DescriptionSeverity
Data Sourced
via NVD·03:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-38653?
CVE-2024-38653 has been classified as a high-severity vulnerability due to its potential for remote exploitation.
2
How do I fix CVE-2024-38653?
To mitigate CVE-2024-38653, users should upgrade to the latest version of Ivanti Avalanche that addresses this vulnerability, specifically version 6.4.4 or higher.
3
What does CVE-2024-38653 allow an attacker to do?
CVE-2024-38653 allows an unauthenticated remote attacker to read arbitrary files on the server, which can lead to sensitive data exposure.
4
Which versions of Ivanti Avalanche are affected by CVE-2024-38653?
Ivanti Avalanche versions 6.3.1 through 6.4.3 are affected by CVE-2024-38653.
5
Is user authentication required to exploit CVE-2024-38653?
No, CVE-2024-38653 can be exploited by unauthenticated attackers, making it particularly dangerous.