CVE-2024-13179

CVE-2024-13179 is a path traversal vulnerability (CWE-22) in Ivanti Avalanche versions prior to 6.4.7 that allows a remote unauthenticated attacker to bypass authentication (CWE-288). Published on January 14, 2025, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.

A remote unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation enables bypassing authentication, potentially resulting in low-impact confidentiality disclosure, integrity modification, and availability disruption.

Ivanti's security advisory for Avalanche 6.4.7 details multiple CVEs, including this one, and recommends upgrading to version 6.4.7 to mitigate the issues.