Lucene search

HackeroneCVE-2024-23529

HistoryApr 19, 2024 - 2:15 a.m.

CVE-2024-23529

2024-04-1902:15:07

CWE-125

hackerone

web.nvd.nist.gov

cve-2024-23529

ivanti avalanche

wlavalancheservice

out-of-bounds read

vulnerability

remote attacker

sensitive information

memory

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

28.8%

JSON

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory.

Affected configurations

Vulners

Vulnrichment

Node

ivantiavalancheRange<6.4.3

VendorProductVersionCPE
ivantiavalanche*cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ivanti	avalanche	*	cpe:2.3:a:ivanti:avalanche::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "Avalanche",
    "versions": [
      {
        "version": "6.4.3",
        "status": "affected",
        "lessThan": "6.4.3",
        "versionType": "semver"
      }
    ]
  }
]

References

forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

28.8%

JSON

Related for CVE-2024-23529