QID 379439

Date Published: 2024-03-11

QID 379439: Ivanti Avalanche Multiple Vulnerabilities

Ivanti Avalanche is a software solution that provides visibility and control of mobile devices and wireless infrastructure. It allows administrators to manage wireless peripherals like mobile printers and scanners.

Ivanti Avalanche 6.4.1 and prior versions are vulnerable to multiple security vulnerabilities.

Affected Version:
Ivanti Avalanche 6.4.1 and prior versions.

QID Detection Logic (Authenticated):
This QID checks for vulnerable versions of Ivanti Avalanche by extracting the version from the 'buildversion.txt' or 'installation.properties' file.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code, leading to complete system compromise.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

Customers are advised to upgrade to Ivanti Avalanche 6.4.2 or later. For more information, please refer to the Ivanti Security Advisory and Ivanti Blog

Vendor References

Ivanti Security Advisory - forums.ivanti.com/s/article/Avalanche-6-4-2-Security-Hardening-and-CVEs-addressed

CVEs related to QID 379439

CVE-2023-41727 | CVE-2023-46216 | CVE-2023-46217 | CVE-2023-46220 | CVE-2023-46221 | CVE-2023-46222 | CVE-2023-46223 | CVE-2023-46224 | CVE-2023-46225 | CVE-2023-46257 | CVE-2023-46258 | CVE-2023-46259 | CVE-2023-46260 | CVE-2023-46261 | CVE-2023-46262 | CVE-2023-46263 | CVE-2021-22962 | CVE-2023-46264 | CVE-2023-46265 | CVE-2023-46266 |

Software Advisories

Advisory ID	Software	Component	Link
Ivanti Security Advisory			forums.ivanti.com/s/article/Avalanche-6-4-2-Security-Hardening-and-CVEs-addressed

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].