CVE-2024-47010

published 2024-10-08

CVE-2024-47010: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.

Priority P1 81 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
ivanti	avalanche	< 6.4.5	6.4.5
ivanti	avalanche	< 6.4.6	6.4.6

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2024-47010 is a Path Traversal vulnerability (CWE-22) in Ivanti Avalanche before 6.4.5 that allows authentication bypass (CWE-288) by a remote unauthenticated attacker. Monitor for path traversal sequences in HTTP requests targeting Ivanti Avalanche endpoints. ↗
• → The fix for CVE-2024-47010 was incomplete; CVE-2024-13181 tracks the bypass of the incomplete fix in versions before 6.4.7. Ensure patching to at least 6.4.7 to fully remediate the authentication bypass via path traversal. ↗

• · Vulnerability affects Ivanti Avalanche versions before 6.4.5 (CVE-2024-47010). The patch was incomplete and a follow-on bypass (CVE-2024-13181) exists in versions before 6.4.7. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22 CWE-288