CVE-2023-41725: 
Ivanti Avalanche vulnerability analysis and mitigation

The Ivanti Avalanche EnterpriseServer Service contains an unrestricted file upload vulnerability that could lead to local privilege escalation (CVE-2023-41725). This vulnerability was discovered and reported through Trend Micro's Zero Day Initiative (ZDI-CAN-21006) and was patched in Avalanche Premise version 6.4.1.236 (Release Notes).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability requires local access, low attack complexity, low privileges, and no user interaction, while potentially impacting confidentiality, integrity, and availability at high levels (NVD).

The vulnerability could allow an attacker with local access to escalate privileges through unrestricted file upload capabilities, potentially leading to complete system compromise with high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability has been fixed in Avalanche Premise version 6.4.1.236. Users should upgrade to this version to address the security issue. The fix was released as part of a security hardening update that addressed multiple vulnerabilities (Release Notes).