CVE-2024-23531

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

A

n Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial of service attacks. In certain rare conditions this could also lead to reading content from memory.

References

Link	Resource
https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US	Vendor Advisory
https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*

History

06 May 2025, 19:23

Type	Values Removed	Values Added
First Time		Ivanti Ivanti avalanche
CPE		cpe:2.3:a:ivanti:avalanche::::::::
References	~~() https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US -~~	() https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US - Vendor Advisory

21 Nov 2024, 08:57

Type	Values Removed	Values Added
References	~~() https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US -~~	() https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US -

03 Jul 2024, 01:47

Type	Values Removed	Values Added
CWE		CWE-190

Information

Published : 2024-04-19 02:15

Updated : 2025-05-06 19:23

NVD link : CVE-2024-23531

Mitre link : CVE-2024-23531

CVE.ORG link : CVE-2024-23531

JSON object : View

Products Affected

avalanche

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2024-23531", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-04-19T02:15:07.670", "references": [{"url": "https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial of service attacks. In certain rare conditions this could also lead to reading content from memory. "}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de enteros en el componente WLInfoRailService de Ivanti Avalanche anterior a 6.4.3 permite a un atacante remoto no autenticado realizar ataques de denegaci\u00f3n de servicio. En determinadas condiciones raras, esto tambi\u00e9n podr\u00eda llevar a leer contenido de la memoria."}], "lastModified": "2025-05-06T19:23:47.330", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA272C74-8C77-482D-A85E-EBC9436C1697", "versionEndExcluding": "6.4.3.528"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}