CVE-2024-38653

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server

High · published August 14, 2024

Patch now

High probability of exploitation

CVSS calls it high at 8.2. It sits in the 99.8th percentile for exploit probability.

CVSS v3.0
8.2
EPSS
92%
Percentile
99.8
In the wild
Unconfirmed
What it is

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.

The record
Technical detail
CVSS v3.0
8.2 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.91984 · 99.8th percentile
Published
2024-08-14T02:38Z
EPSS history
Timeline
  • 14 AUG 02:38Z
    XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server
    cvelistv5