CVE-2024-47011

published 2024-10-08

CVE-2024-47011: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information

Priority P2 64 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information

Affected

2 ranges

Vendor	Product	Version range	Fixed in
ivanti	avalanche	< 6.4.5	6.4.5
ivanti	avalanche	< 6.4.7	6.4.7

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2024-47011 is a Path Traversal (CWE-22) vulnerability in Ivanti Avalanche before version 6.4.5, exploitable by a remote unauthenticated attacker to leak sensitive information. Monitor for unauthenticated HTTP requests containing path traversal sequences (e.g., '../') targeting Ivanti Avalanche endpoints. ↗
• → CVE-2024-13180 addresses an incomplete fix for CVE-2024-47011 — systems patched to 6.4.5 but below 6.4.7 remain vulnerable. Ensure Ivanti Avalanche is upgraded to at least 6.4.7 to fully remediate the path traversal vector. ↗

• · The fix for CVE-2024-47011 (patched in Ivanti Avalanche 6.4.5) was incomplete; the same path traversal class of vulnerability persisted and was re-addressed in CVE-2024-13180, requiring upgrade to version 6.4.7 or later for full remediation. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22