CVE-2021-30497

Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal

published April 6, 2022

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.9th percentile for exploit probability.

CVSS
—
EPSS
97%
Percentile
99.9
In the wild
Unconfirmed
What it is

Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive information via the C:/Windows/system32/config/system.sav value.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.96580 · 99.9th percentile
Published
2022-04-06T01:22Z
EPSS history
Timeline
  • 06 APR 01:22Z
    Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal
    cvelistv5