Ivanti Avalanche Path Traversal Vulnerability Allowing Authentication Bypass

A path traversal vulnerability has been identified in Ivanti Avalanche versions prior to 6.4.7. This vulnerability allows remote unauthenticated attackers to bypass authentication. The issue arises from incomplete fixes in a previous vulnerability (CVE-2024-47010).

Impact

Exploitation of this vulnerability allows for authentication bypass, potentially leading to unauthorized access or actions within the application.

Remediation

Users can upgrade to Ivanti Avalanche version 6.4.7 to address this vulnerability. This release is a full product install, and users should perform an in-place upgrade according to the product documentation.