CVE-2023-46262: 
Ivanti Avalanche vulnerability analysis and mitigation

CVE-2023-46262 is a Server-Side Request Forgery (SSRF) vulnerability discovered in Ivanti Avalanche Remote Control server. The vulnerability was disclosed on December 19, 2023, affecting Ivanti Avalanche versions up to 6.4.1. This vulnerability allows an unauthenticated attacker to send specifically crafted web requests to the server (NVD).

The vulnerability exists within the validateAMCWSConnection method of the Ivanti Avalanche Remote Control server. The core issue stems from the lack of proper validation of a URI prior to accessing resources. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and no required privileges or user interaction (ZDI).

The successful exploitation of this vulnerability can lead to the disclosure of sensitive information in the context of SYSTEM privileges. An attacker can leverage this vulnerability to access and potentially exfiltrate confidential data from the affected system (ZDI).

Ivanti has released version 6.4.2 of Avalanche to address this vulnerability along with several other security issues. Organizations are strongly advised to upgrade to this version to mitigate the risk (Ivanti Blog, Release Notes).