Ivanti Avalanche Multiple CVEs Advisory: DoS and Info Leak (CVE-2024-50317 to 50331)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Ivanti Avalanche (Multiple CVEs) - Q4 2024 Release 2. Affected Product: Ivanti Avalanche 3. Vulnerability Description: - CVE-2024-50317: A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. - CVE-2024-50318: A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. - CVE-2024-50319: An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. - CVE-2024-50320: An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. - CVE-2024-50331: An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information in memory. 4. Vulnerability Severity: All vulnerabilities have a CVSS Score of 7.5 (High) 5. Affected Versions: Ivanti Avalanche 6.4.5 and earlier versions 6. Solution: Perform a full product installation and upgrade in-place according to the product documentation. 7. Affected CPE: 8. Fixed Version: 6.4.6 9. Patch Availability: Download Portal 10. Disclosure Date: November 11, 2024 11. Last Modified Date: November 12, 2024 12. Vulnerability Details: Includes description, CVSS Score, CVSS Vector, and CWE number. 13. FAQ: - 1. Is there any known active exploitation? - No, no customer exploitation has been identified prior to public disclosure. - 2. How to determine if already attacked? - There is no known public exploitation; therefore, no indicators of compromise can be provided. - 3. What to do if needing help? - Submit a request via the Success Portal for assistance. This information provides a detailed description and resolution guidance, helping users understand and respond to these security threats.

Goal Reached Thanks to every supporter — we hit 100%!

Ivanti Avalanche Multiple CVEs Advisory: DoS and Info Leak (CVE-2024-50317 to 50331)