This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Ivanti fixes 8 vulnerabilities in various products

Ivanti fixes 8 vulnerabilities in Neurons for ITSM, Virtual Traffic Manager and Avalanche [1][2][3]. The vulnerabilities in Neurons for ITSM were fixed by a patch [1]. Products and their fixed versions: Ivanti Neurons for ITSM - 2023.4 w/ patch [4], 2023.3 w/ patch [5], 2023.2 w/ patch [6] Ivanti Virtual Traffic Manager - 22.2R1, 22.3R3, 22.3R3, 22.5R2, 22.6R2, 22.7R2 [2] Ivanti Avalanche - 6.4.4 [3]

Ivanti Neurons for ITSM - information leak (CVE-2024-7569)
CVSS 9.6 (Critical)

An unauthenticated remote attacker can obtain the OIDC secret in Ivanti Neurons for ITSM using a debugging tool [7].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 8. 2024.

Ivanti Neurons for ITSM - access token craft (CVE-2024-7570)
CVSS 8.3 (High)

An unauthenticated remote attacker can create an access token to the system in Ivanti Neurons for ITSM and thereby impersonate any user [7].

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 8. 2024.

Ivanti Virtual Traffic Manager - authentication bypass (CVE-2024-7593)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can bypass authentication in Ivanti Virtual Traffic Manager when accessing the administrator panel [8].

The vulnerability is present in product:

  • Ivanti Virtual Traffic Manager; >=22.2, <22.2R1; >=22.3, <22.3R3; >=22.3R2, <22.3R3; >=22.5R1, <22.5R2; >=22.6R1, <22.6R2; >=22.7R1, <22.7R2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 12. 8. 2024.

Ivanti Avalanche - DoS (CVE-2024-38652)
CVSS 8.2 (High)

An unauthenticated remote attacker can carry out a DoS attack in Ivanti Avalanche by deleting critical files from the system without authorization [9].

The vulnerability is present in product:

  • Ivanti Avalanche; <6.44;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

More information:

  • CVE-2024-38652 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 8. 2024.

Ivanti Avalanche - XXE (CVE-2024-38653)
CVSS 8.2 (High)

An unauthenticated remote attacker can carry out an XXE attack in Ivanti Avalanche and thereby access arbitrary files [9].

The vulnerability is present in product:

  • Ivanti Avalanche; <6.44;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

More information:

The vulnerability was publicly disclosed 13. 8. 2024.

Ivanti Avalanche - DoS (CVE-2024-36136)
CVSS 7.5 (High)

An unauthenticated remote attacker can carry out a DoS attack in Ivanti Avalanche through a stack overflow [9].

The vulnerability is present in product:

  • Ivanti Avalanche; <6.44;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 13. 8. 2024.

Ivanti Avalanche - DoS (CVE-2024-37399)
CVSS 7.5 (High)

An unauthenticated remote attacker can carry out a DoS attack in Ivanti Avalanche through a NULL pointer dereference [10].

The vulnerability is present in product:

  • Ivanti Avalanche; <6.44;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 13. 8. 2024.

Ivanti Avalanche - RCE (CVE-2024-37373)
CVSS 7.2 (High)

An authenticated remote attacker with administrator privileges can execute code without authorization in Ivanti Avalanche [9].

The vulnerability is present in product:

  • Ivanti Avalanche; <6.4.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 8. 2024.

By CESNET, z.s.p.o. Martin Krajči on 16. 8. 2024.

CESNET, z.s.p.o. Logo