CVE-2023-46264

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Dec 19, 2023
Updated: Dec 21, 2023
CWE ID 434

Summary

CVE-2023-46264 is a vulnerability affecting Avalanche versions 6.4.1 and below. This issue permits an unauthenticated attacker to upload any file type, including malicious code, which could result in arbitrary code execution on the affected system. The vulnerability stems from a lack of restriction on the type of files that can be uploaded, posing a significant risk to security. Successful exploitation of this flaw could lead to serious consequences, including system compromise and data theft. It is strongly recommended that users update to the latest version of Avalanche as soon as possible to mitigate this threat.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Ivanti Avalanche

Affected Vendors

  • Ivanti Software Inc.