CVE-2024-13180: 
Ivanti Avalanche vulnerability analysis and mitigation

A path traversal vulnerability identified as CVE-2024-13180 affects Ivanti Avalanche versions prior to 6.4.7. This vulnerability allows remote unauthenticated attackers to leak sensitive information. Notably, this CVE addresses incomplete fixes from a previous vulnerability (CVE-2024-47011) (NVD).

The vulnerability is classified as a path traversal issue (CWE-22) with a CVSS v3.1 base score of 7.5 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U) with high confidentiality impact (C:H) but no impact on integrity (I:N) or availability (A:N) (NVD).

The vulnerability enables unauthorized access to sensitive information through path traversal techniques. The high confidentiality impact rating indicates that attackers can gain access to sensitive data, while system integrity and availability remain unaffected (SecurityWeek).

The vulnerability can be exploited remotely by unauthenticated attackers. As of January 2025, Ivanti has stated that there is no evidence of this vulnerability being exploited in the wild (SecurityWeek).

Ivanti has released version 6.4.7 of Avalanche to address this vulnerability. Organizations are strongly advised to update their Ivanti Avalanche installations to this latest version as soon as possible (ASEC).