ZDI-CAN-24375: ZDI-24-1695: Ivanti Avalanche FileStoreConfig Unrestricted File Upload Remote Code Execution Vulnerability
Published Dec 17, 2024
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2024-37373.
Affected Software
1 affected component
Ivanti Avalanche
Event History
Dec 17, 2024
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-24375?
The severity of ZDI-CAN-24375 is rated at 7.2 on the CVSS scale.
2
How can I patch ZDI-CAN-24375?
To fix ZDI-CAN-24375, you should update your Ivanti Avalanche installation to the latest version provided by the vendor.
3
What are the potential impacts of ZDI-CAN-24375?
ZDI-CAN-24375 allows remote attackers to execute arbitrary code on affected systems, which can lead to unauthorized access or data breaches.
4
Is authentication required to exploit ZDI-CAN-24375?
Yes, authentication is required to exploit ZDI-CAN-24375.
5
Which software is affected by ZDI-CAN-24375?
ZDI-CAN-24375 affects installations of Ivanti Avalanche.