CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32561 – Ivanti Avalanche dumpHeap Incorrect Permission Assignment Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-32561
A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed in version 6.4.1. This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dumpHeap method. • https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2023-32562 – Ivanti Avalanche FileStoreConfig Arbitrary File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-32562
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileStoreConfig endpoint. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. • https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 39%CPEs: 1EXPL: 0CVE-2023-32563 – Ivanti Avalanche updateSkin Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-32563
An unauthenticated attacker could achieve the code execution through a RemoteControl server. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the updateSkin method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. • https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US https://twitter.com/wvuuuuuuuuuuuuu/status/1694956245742923939 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2023-32564 – Ivanti Avalanche FileStoreConfig Arbitrary File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-32564
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileStoreConfig app. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. • https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32565 – Ivanti Avalanche SecureFilter Content-Type Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-32565
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1. This vulnerability allows remote attackers to partially bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecureFilter class. The issue results from improperly using the Content-Type HTTP header in authorization logic. • https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US •