CVE-2024-38652

CRITICAL 9.1CVE-2024-38652 · Published 14/08/2024 · updated 17/06/2026

In short

CVE-2024-38652 is a CRITICAL (CVSS 9.1) vulnerability affecting avalanche (ivanti).
Chance of exploitation in the next 30 days (EPSS): 7.6%, higher than 94.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
avalanche ivanti	`= 6.3.1= 6.3.1.1507= 6.3.2= 6.3.2.3490= 6.3.3= 6.3.3.101= 6.3.4= 6.3.4.153= 6.4.0= 6.4.1= 6.4.1.207= 6.4.1.236= 6.4.2`	No fix yet

Description

Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary file deletion.

References

forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373 · Vendor Advisory

More vulnerabilities in avalanche

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

avalanche

ivanti

= 6.3.1= 6.3.1.1507= 6.3.2= 6.3.2.3490= 6.3.3= 6.3.3.101= 6.3.4= 6.3.4.153= 6.4.0= 6.4.1= 6.4.1.207= 6.4.1.236= 6.4.2

No fix yet

More vulnerabilities in avalanche

See all →