This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Ivanti Avalanche 6.4.3 fixes 27 vulnerabilities, 2 of them critical
Ivanti Avalanche version 6.4.3 fixes 27 vulnerabilities, two of them critical. The other 25 vulnerabilities have medium to high severity and may lead to denial of service, unauthorized command execution as SYSTEM and disclosure of sensitive information [1].
An unauthenticated remote attacker can, due to a heap overflow error in the WLAvalancheService component, execute arbitrary commands on the affected system without user interaction [1].
The vulnerability is present in product:
- Ivanti Avalanche; <6.4.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-29204 at cve.org, NVD
- CWE-122 at cwe.mitre.org
The vulnerability was publicly disclosed 17. 4. 2024.
An unauthenticated remote attacker can, due to a heap overflow error in the WLInfoRailService component, execute arbitrary commands on the affected system without user interaction [1].
The vulnerability is present in product:
- Ivanti Avalanche; <6.4.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-24996 at cve.org, NVD
- CWE-122 at cwe.mitre.org
The vulnerability was publicly disclosed 17. 4. 2024.
By CESNET, z.s.p.o. Michaela Jarošová on 18. 4. 2024.