Threat Encyclopedia

Ivanti.Avalanch.uploadFile.Directory.Traversal

description-logoDescription

This indicates an attack attempt to exploit a Directory Traversal Vulnerability in Ivanti Avalanche.
This vulnerability is due to a insufficient validation of input in the DeviceLogResource class for the Smart Device Server. A remote attacker could exploit this vulnerability by sending crafted requests to the target server. Successfully exploiting this vulnerability could result in remote code execution in the context of SYSTEM.

affected-products-logoAffected Products

Ivanti Avalanche prior to 6.3.4

Impact logoImpact

System Compromise: Remote attackers can gain control of vulnerable systems.

recomended-action-logoRecommended Actions

Apply the most recent upgrade or patch from the vendor.
https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt

CVE References

CVE-2022-36981

Telemetry logoTelemetry