An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
Una vulnerabilidad de carga de archivos sin restricciones en el componente web de Ivanti Avalanche anterior a 6.4.3 permite a un atacante remoto autenticado ejecutar comandos arbitrarios como SYSTEM.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability.
The specific flaw exists within the getMasterAdhocCollectionsPath method. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
