Vulnerability-Lookup

CVE-2024-38653 (GCVE-0-2024-38653)

Vulnerability from cvelistv5 – Published: 2024-08-14 02:38 – Updated: 2024-08-14 13:47

Previdian

Summary

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.

Severity

8.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-14 13:21 UTC

CWE

CWE-611 - Improper Restriction of XML External Entity Reference

Assigner

hackerone mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

2 products

Vendor	Product	Version
Ivanti	Avalanche	Affected: 6.4.4 , < 6.4.4 (custom)
ivanti	avalanche	Affected: 6.3.1 , < 6.4.4 (custom) cpe:2.3:a:ivanti:avalanche::::::::

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 4767b833-f263-4801-93e8-312214974657

Vulnerability ID: CVE-2024-38653

Status: Confirmed

Status Updated: 2025-09-05 02:00 CEST

Exploited: Yes

Timestamps

First Seen: 2025-09-05

Asserted: 2025-09-05

Scope

Notes: XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server. | Affected: Ivanti / Avalanche | CVSS: 8.2 (HIGH) | EPSS: 0.91984 | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.
Cve Id	CVE-2024-38653
Vendor	Ivanti
Ghsa Id	GHSA-6JJX-98R4-VCM4
Product	Avalanche
Added Date	2025-09-05T00:00:00.000Z
Cvss Score	8.2
Epss Score	0.91984
Previous Ids
Cvss Severity	HIGH
Virtual Patch	False
Cvss Estimated	False
Epss Percentile	0.99818
Used In Malware	unknown
Vulnerability Id	CVE-2024-38653
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-10-02 09:09 CEST | Updated: 2026-10-02 09:09 CEST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "avalanche",
            "vendor": "ivanti",
            "versions": [
              {
                "lessThan": "6.4.4",
                "status": "affected",
                "version": "6.3.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38653",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-14T13:21:08.532288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-611",
                "description": "CWE-611 Improper Restriction of XML External Entity Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-14T13:47:52.793Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Avalanche",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "6.4.4",
              "status": "affected",
              "version": "6.4.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-14T02:38:00.149Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-38653",
    "datePublished": "2024-08-14T02:38:00.149Z",
    "dateReserved": "2024-06-19T01:04:07.137Z",
    "dateUpdated": "2024-08-14T13:47:52.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38653",
      "date": "2026-10-04",
      "epss": "0.91984",
      "percentile": "0.99819"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Avalanche",
                "vendor": "Ivanti",
                "versions": [
                  {
                    "lessThan": "6.4.4",
                    "status": "affected",
                    "version": "6.4.4",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "support@hackerone.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "avalanche",
                "vendor": "ivanti",
                "versions": [
                  {
                    "lessThan": "6.4.4",
                    "status": "affected",
                    "version": "6.3.1",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.1:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "6060540C-A977-4E2A-8E1B-41CC3C3E92ED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.1.1507:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "771C1447-6F5E-45DE-BDE6-8FFBB4708D67",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "778D9C09-12BB-47FC-B74B-DC114AE3A540",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "617DA85C-5FCE-4650-99AA-A1052E690B2C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "44ABD265-3F8F-415A-96B3-16975661CDEB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CF93250C-0754-4B87-9BBE-DDF255EEB157",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "521CD0B6-8348-41D6-8AD8-79F884F4F10F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3162335B-9FA4-4AC3-85F0-BD34F859EDFB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "03E7F6CA-8A72-4A3E-A281-2A7653162FB3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E2AB421E-C976-4CFF-93F9-40354CB579C5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "4C581973-06B3-4E16-B37C-41FE7B4388CB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE9E1AF8-A8ED-4E49-B25F-E27AD4B61E7D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "3CC6AA75-22CD-4588-A1F9-574D7E7698CF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.4.153:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "F5A7D50A-DD35-40B6-B4AD-8703DB016E90",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1196CC8F-4D46-4258-9997-1C7E9954A8D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DF9D82B4-4AF6-4E14-AACE-56982D4F8969",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "5FA149E2-AF10-4D3A-9F6C-8AF74110DEF8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1.207:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "CC521F86-4E3F-4217-836D-235B1D9E8876",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1.236:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "45AA1E4F-2B38-42A3-A99C-F7ED17067E00",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.2:*:*:*:premise:*:*:*",
                    "matchCriteriaId": "78794BF3-682E-4256-92DA-D669BF78A297",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server."
          },
          {
            "lang": "es",
            "value": "XXE en SmartDeviceServer en Ivanti Avalanche 6.3.1 permite que un atacante remoto no autenticado lea archivos arbitrarios en el servidor."
          }
        ],
        "id": "CVE-2024-38653",
        "lastModified": "2026-06-17T07:40:48.370",
        "metrics": {
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
                "version": "3.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "support@hackerone.com",
              "type": "Secondary"
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-38653",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-14T13:21:08.532288Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-14T03:15:05.200",
        "references": [
          {
            "source": "support@hackerone.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373"
          }
        ],
        "sourceIdentifier": "support@hackerone.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-611"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-611"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "avalanche",
                "vendor": "ivanti",
                "versions": [
                  {
                    "lessThan": "6.4.4",
                    "status": "affected",
                    "version": "6.3.1",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-38653",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-08-14T13:21:08.532288Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-611",
                    "description": "CWE-611 Improper Restriction of XML External Entity Reference",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-14T13:36:28.232Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Avalanche",
              "vendor": "Ivanti",
              "versions": [
                {
                  "lessThan": "6.4.4",
                  "status": "affected",
                  "version": "6.4.4",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server."
            }
          ],
          "metrics": [
            {
              "cvssV3_0": {
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
                "version": "3.0"
              }
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-08-14T02:38:00.149Z",
            "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            "shortName": "hackerone"
          },
          "references": [
            {
              "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "assignerShortName": "hackerone",
        "cveId": "CVE-2024-38653",
        "datePublished": "2024-08-14T02:38:00.149Z",
        "dateReserved": "2024-06-19T01:04:07.137Z",
        "dateUpdated": "2024-08-14T13:47:52.793Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2024-10277 (CVE-2024-38653)

Vulnerability from fstec – Published: 2024-11-26 – Updated: 2024-11-26 – View on bdu.fstec.ru Exploit exists Fixed

Previdian

Title

Уязвимость компонента SmartDeviceServer системы управления мобильными устройствами Ivanti Avalanche, позволяющая нарушителю раскрыть защищаемую информацию

Summary

Уязвимость компонента SmartDeviceServer системы управления мобильными устройствами Ivanti Avalanche связана с неверным ограничением XML-ссылок на внешние объекты. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, раскрыть защищаемую информацию

Severity

8.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:N/A:P

8.2 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Injection

Incidents

Being clarified

Remediation

Software update

CWE

CWE-611 - Неверное ограничение XML-ссылок на внешние объекты

Aliases

CVE-2024-38653, ZDI-24-1150, ZDI-CAN-22083

References

2 references

URL
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CV…
https://www.zerodayinitiative.com/advisories/ZDI-CAN-22083/

Impacted products

1 product from 1 vendor

Vendors

Ivanti

Products

Avalanche

Versions

6.3.4.153 (Avalanche), 6.3.1 (Avalanche), 6.3.1.1507 (Avalanche), 6.3.2 (Avalanche), 6.3.2.3490 (Avalanche), 6.3.3 (Avalanche), 6.3.3.101 (Avalanche), 6.3.4 (Avalanche), 6.4.0 (Avalanche), 6.4.1 (Avalanche), 6.4.1.207 (Avalanche), 6.4.1.236 (Avalanche), 6.4.2 (Avalanche)

Product types

Network device, Network software

Mitigations

Использование рекомендаций производителя: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373?language=en_US

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:N/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Ivanti",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "6.3.4.153 (Avalanche), 6.3.1 (Avalanche), 6.3.1.1507 (Avalanche), 6.3.2 (Avalanche), 6.3.2.3490 (Avalanche), 6.3.3 (Avalanche), 6.3.3.101 (Avalanche), 6.3.4 (Avalanche), 6.4.0 (Avalanche), 6.4.1 (Avalanche), 6.4.1.207 (Avalanche), 6.4.1.236 (Avalanche), 6.4.2 (Avalanche)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373?language=en_US",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "13.08.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "26.11.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "26.11.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-10277",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-38653, ZDI-24-1150, ZDI-CAN-22083",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Avalanche",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 SmartDeviceServer \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438 Ivanti Avalanche, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 XML-\u0441\u0441\u044b\u043b\u043e\u043a \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u044b (CWE-611)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 SmartDeviceServer \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438 Ivanti Avalanche \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c XML-\u0441\u0441\u044b\u043b\u043e\u043a \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u044b. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373?language=en_US\nhttps://www.zerodayinitiative.com/advisories/ZDI-CAN-22083/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-611",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,2)"
}

EUVD-2026-158449

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 06:37

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T06:37:33.190603+00:00",
  "id": "EUVD-2026-158449"
}

FKIE_CVE-2024-38653

Vulnerability from fkie_nvd - Published: 2024-08-14 03:15 - Updated: 2026-06-17 07:40

Previdian

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.

References

	URL	Tags
	support@hackerone.com	https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373	Vendor Advisory

Impacted products

Vendor	Product	Version
ivanti	avalanche	6.3.1
ivanti	avalanche	6.3.1.1507
ivanti	avalanche	6.3.2
ivanti	avalanche	6.3.2
ivanti	avalanche	6.3.2
ivanti	avalanche	6.3.2.3490
ivanti	avalanche	6.3.2.3490
ivanti	avalanche	6.3.3
ivanti	avalanche	6.3.3
ivanti	avalanche	6.3.3.101
ivanti	avalanche	6.3.3.101
ivanti	avalanche	6.3.4
ivanti	avalanche	6.3.4
ivanti	avalanche	6.3.4.153
ivanti	avalanche	6.4.0
ivanti	avalanche	6.4.1
ivanti	avalanche	6.4.1
ivanti	avalanche	6.4.1.207
ivanti	avalanche	6.4.1.236
ivanti	avalanche	6.4.2

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Avalanche",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "6.4.4",
              "status": "affected",
              "version": "6.4.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "support@hackerone.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "avalanche",
          "vendor": "ivanti",
          "versions": [
            {
              "lessThan": "6.4.4",
              "status": "affected",
              "version": "6.3.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.1:*:*:*:premise:*:*:*",
              "matchCriteriaId": "6060540C-A977-4E2A-8E1B-41CC3C3E92ED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.1.1507:*:*:*:premise:*:*:*",
              "matchCriteriaId": "771C1447-6F5E-45DE-BDE6-8FFBB4708D67",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "778D9C09-12BB-47FC-B74B-DC114AE3A540",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:windows:*:*",
              "matchCriteriaId": "617DA85C-5FCE-4650-99AA-A1052E690B2C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:premise:*:*:*",
              "matchCriteriaId": "44ABD265-3F8F-415A-96B3-16975661CDEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF93250C-0754-4B87-9BBE-DDF255EEB157",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:premise:*:*:*",
              "matchCriteriaId": "521CD0B6-8348-41D6-8AD8-79F884F4F10F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "3162335B-9FA4-4AC3-85F0-BD34F859EDFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:premise:*:*:*",
              "matchCriteriaId": "03E7F6CA-8A72-4A3E-A281-2A7653162FB3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2AB421E-C976-4CFF-93F9-40354CB579C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:premise:*:*:*",
              "matchCriteriaId": "4C581973-06B3-4E16-B37C-41FE7B4388CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE9E1AF8-A8ED-4E49-B25F-E27AD4B61E7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:premise:*:*:*",
              "matchCriteriaId": "3CC6AA75-22CD-4588-A1F9-574D7E7698CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.3.4.153:*:*:*:premise:*:*:*",
              "matchCriteriaId": "F5A7D50A-DD35-40B6-B4AD-8703DB016E90",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1196CC8F-4D46-4258-9997-1C7E9954A8D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF9D82B4-4AF6-4E14-AACE-56982D4F8969",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:premise:*:*:*",
              "matchCriteriaId": "5FA149E2-AF10-4D3A-9F6C-8AF74110DEF8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1.207:*:*:*:premise:*:*:*",
              "matchCriteriaId": "CC521F86-4E3F-4217-836D-235B1D9E8876",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1.236:*:*:*:premise:*:*:*",
              "matchCriteriaId": "45AA1E4F-2B38-42A3-A99C-F7ED17067E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:avalanche:6.4.2:*:*:*:premise:*:*:*",
              "matchCriteriaId": "78794BF3-682E-4256-92DA-D669BF78A297",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server."
    },
    {
      "lang": "es",
      "value": "XXE en SmartDeviceServer en Ivanti Avalanche 6.3.1 permite que un atacante remoto no autenticado lea archivos arbitrarios en el servidor."
    }
  ],
  "id": "CVE-2024-38653",
  "lastModified": "2026-06-17T07:40:48.370",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "support@hackerone.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38653",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-08-14T13:21:08.532288Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-08-14T03:15:05.200",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-6JJX-98R4-VCM4

Vulnerability from github – Published: 2024-08-14 03:31 – Updated: 2024-08-14 03:31

Details

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.

Severity

8.2 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-38653"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-14T03:15:05Z",
    "severity": "HIGH"
  },
  "details": "XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.",
  "id": "GHSA-6jjx-98r4-vcm4",
  "modified": "2024-08-14T03:31:10Z",
  "published": "2024-08-14T03:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38653"
    },
    {
      "type": "WEB",
      "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2024-1846

Vulnerability from csaf_certbund - Published: 2024-08-13 22:00 - Updated: 2024-08-13 22:00

Summary

Ivanti Avalanche: Mehrere Schwachstellen

Severity

Hoch

Scope

5 vulnerabilities in this advisory, including CVE-2024-38653.

CVE-2024-38653

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-38653 (GCVE-0-2024-38653)

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

BDU:2024-10277 (CVE-2024-38653)

EUVD-2026-158449

FKIE_CVE-2024-38653

GHSA-6JJX-98R4-VCM4

WID-SEC-W-2024-1846

Tags

Sightings

Nomenclature

Related by attack behaviour