CVE-2024-38652

An attacker sends a crafted network request to the skin management component, specifying a path containing path traversal sequences (e.g., '../'). The lack of proper path validation and sanitization allows stepping outside the permitted directory and targeting any file in the system. As a result, the attacker can delete arbitrary files, leading to disruption or complete shutdown of the service.

An unauthenticated attacker can permanently delete arbitrary files on the server, causing denial of service (DoS) and violating system integrity. Loss of critical configuration or system files may prevent the Ivanti Avalanche server from functioning properly.

Ivanti Avalanche should be updated to version 6.4.4 or newer, in accordance with the official security bulletin from the vendor available at the address indicated in the references. Until the patch is deployed, it is recommended to restrict network access to the Ivanti Avalanche management interface only to trusted IP addresses.

Ivanti Avalanche version 6.3.1 (as per the vendor's description; detailed version scope indicated in vendor references)