The version of Ivanti Avalanche running on the remote host is prior to 6.4.3. It is, therefore, is affected by multiple vulnerabilities :

  - A Heap overflow vulnerability in WLInfoRailService component of Ivanti     Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary commands. (CVE-2024-24996)

  - A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote     authenticated attacker to execute arbitrary commands as SYSTEM. (CVE-2024-24997)

  - An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a     remote authenticated attacker to execute arbitrary commands as SYSTEM. (CVE-2024-23534)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ivanti Avalanche < 6.4.3 Multiple Vulnerabilities

critical Nessus Plugin ID 211473

Version 1.2