Ivanti Avalanche Path Traversal Vulnerability Allowing Sensitive Information Disclosure

A path traversal vulnerability has been identified in Ivanti Avalanche versions prior to 6.4.7. This vulnerability allows remote unauthenticated attackers to leak sensitive information. It is important to note that this CVE addresses incomplete fixes from a previous vulnerability, CVE-2024-47011.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information.

Remediation

Users can upgrade to Ivanti Avalanche version 6.4.7. This release is a full product install, and an in-place upgrade can be performed as per the product documentation.