CVE-2024-36136 - Vulnerability Details

Vendors	Products
Ivanti	Avalanche

Link	Providers
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:ivanti:avalanche:6.3.1.1507::::premise::: cpe:2.3:a:ivanti:avalanche:6.3.1::::premise::: cpe:2.3:a:ivanti:avalanche:6.3.2.3490:::::::* cpe:2.3:a:ivanti:avalanche:6.3.2.3490::::premise::: cpe:2.3:a:ivanti:avalanche:6.3.2:::::::* cpe:2.3:a:ivanti:avalanche:6.3.2:::::windows:: cpe:2.3:a:ivanti:avalanche:6.3.2::::premise::: cpe:2.3:a:ivanti:avalanche:6.3.3.101:::::::* cpe:2.3:a:ivanti:avalanche:6.3.3.101::::premise::: cpe:2.3:a:ivanti:avalanche:6.3.3:::::::* cpe:2.3:a:ivanti:avalanche:6.3.3::::premise::: cpe:2.3:a:ivanti:avalanche:6.3.4.153::::premise::: cpe:2.3:a:ivanti:avalanche:6.3.4:::::::* cpe:2.3:a:ivanti:avalanche:6.3.4::::premise::: cpe:2.3:a:ivanti:avalanche:6.4.0:::::::* cpe:2.3:a:ivanti:avalanche:6.4.1.207::::premise::: cpe:2.3:a:ivanti:avalanche:6.4.1.236::::premise::: cpe:2.3:a:ivanti:avalanche:6.4.1:::::::* cpe:2.3:a:ivanti:avalanche:6.4.1::::premise::: cpe:2.3:a:ivanti:avalanche:6.4.2::::premise:::
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Type	Values Removed	Values Added
First Time appeared		Ivanti Ivanti avalanche
Weaknesses		CWE-193
CPEs		cpe:2.3:a:ivanti:avalanche::::::::
Vendors & Products		Ivanti Ivanti avalanche
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.
References		https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373
Metrics		cvssV3_0 `{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36136", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2024-05-21T01:04:07.208Z", "datePublished": "2024-08-14T02:38:00.141Z", "dateUpdated": "2024-08-14T13:57:53.500Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Ivanti", "product": "Avalanche", "versions": [{"version": "6.4.4", "status": "affected", "lessThan": "6.4.4", "versionType": "semver"}]}], "references": [{"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2024-08-14T02:38:00.141Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-193", "lang": "en", "description": "CWE-193 Off-by-one Error"}]}], "affected": [{"vendor": "ivanti", "product": "avalanche", "cpes": ["cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "6.3.1", "status": "affected", "lessThan": "6.4.4", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-14T13:56:27.568136Z", "id": "CVE-2024-36136", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-14T13:57:53.500Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-36136 (string)

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

state : PUBLISHED (string)

assignerShortName : hackerone (string)

dateReserved : 2024-05-21T01:04:07.208Z (string)

datePublished : 2024-08-14T02:38:00.141Z (string)

dateUpdated : 2024-08-14T13:57:53.500Z (string)

}

containers : { »

cna : { »

descriptions : [ »

0 : { »

lang : en (string)

value : An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS. (string)

}

]

affected : [ »

0 : { »

defaultStatus : unaffected (string)

vendor : Ivanti (string)

product : Avalanche (string)

versions : [ »

0 : { »

version : 6.4.4 (string)

status : affected (string)

lessThan : 6.4.4 (string)

versionType : semver (string)

}

]

}

]

references : [ »

0 : { »

url : https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373 (string)

}

]

metrics : [ »

0 : { »

cvssV3_0 : { »

version : 3.0 (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

}

]

providerMetadata : { »

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

dateUpdated : 2024-08-14T02:38:00.141Z (string)

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-193 (string)

lang : en (string)

description : CWE-193 Off-by-one Error (string)

}

]

}

]

affected : [ »

0 : { »

vendor : ivanti (string)

product : avalanche (string)

cpes : [ »

0 : cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 6.3.1 (string)

status : affected (string)

lessThan : 6.4.4 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-14T13:56:27.568136Z (string)

id : CVE-2024-36136 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-14T13:57:53.500Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36136", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-14T13:56:27.568136Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*"], "vendor": "ivanti", "product": "avalanche", "versions": [{"status": "affected", "version": "6.3.1", "lessThan": "6.4.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-193", "description": "CWE-193 Off-by-one Error"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-14T13:56:49.596Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "Ivanti", "product": "Avalanche", "versions": [{"status": "affected", "version": "6.4.4", "lessThan": "6.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373"}], "descriptions": [{"lang": "en", "value": "An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2024-08-14T02:38:00.141Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36136", "state": "PUBLISHED", "dateUpdated": "2024-08-14T13:57:53.500Z", "dateReserved": "2024-05-21T01:04:07.208Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2024-08-14T02:38:00.141Z", "assignerShortName": "hackerone"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-36136 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-14T13:56:27.568136Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:* (string)

]

vendor : ivanti (string)

product : avalanche (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.3.1 (string)

lessThan : 6.4.4 (string)

versionType : custom (string)

}

]

defaultStatus : unaffected (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-193 (string)

description : CWE-193 Off-by-one Error (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-14T13:56:49.596Z (string)

}

]

cna : { »

metrics : [ »

0 : { »

cvssV3_0 : { »

version : 3.0 (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

}

]

affected : [ »

0 : { »

vendor : Ivanti (string)

product : Avalanche (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.4.4 (string)

lessThan : 6.4.4 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS. (string)

}

]

providerMetadata : { »

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

dateUpdated : 2024-08-14T02:38:00.141Z (string)

}

cveMetadata : { »

cveId : CVE-2024-36136 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-14T13:57:53.500Z (string)

dateReserved : 2024-05-21T01:04:07.208Z (string)

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

datePublished : 2024-08-14T02:38:00.141Z (string)

assignerShortName : hackerone (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.1:*:*:*:premise:*:*:*", "matchCriteriaId": "6060540C-A977-4E2A-8E1B-41CC3C3E92ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.1.1507:*:*:*:premise:*:*:*", "matchCriteriaId": "771C1447-6F5E-45DE-BDE6-8FFBB4708D67", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "778D9C09-12BB-47FC-B74B-DC114AE3A540", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:windows:*:*", "matchCriteriaId": "617DA85C-5FCE-4650-99AA-A1052E690B2C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:premise:*:*:*", "matchCriteriaId": "44ABD265-3F8F-415A-96B3-16975661CDEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:*:*:*:*", "matchCriteriaId": "CF93250C-0754-4B87-9BBE-DDF255EEB157", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:premise:*:*:*", "matchCriteriaId": "521CD0B6-8348-41D6-8AD8-79F884F4F10F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "3162335B-9FA4-4AC3-85F0-BD34F859EDFB", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:premise:*:*:*", "matchCriteriaId": "03E7F6CA-8A72-4A3E-A281-2A7653162FB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:*:*:*:*", "matchCriteriaId": "E2AB421E-C976-4CFF-93F9-40354CB579C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:premise:*:*:*", "matchCriteriaId": "4C581973-06B3-4E16-B37C-41FE7B4388CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "FE9E1AF8-A8ED-4E49-B25F-E27AD4B61E7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:premise:*:*:*", "matchCriteriaId": "3CC6AA75-22CD-4588-A1F9-574D7E7698CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.3.4.153:*:*:*:premise:*:*:*", "matchCriteriaId": "F5A7D50A-DD35-40B6-B4AD-8703DB016E90", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "1196CC8F-4D46-4258-9997-1C7E9954A8D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "DF9D82B4-4AF6-4E14-AACE-56982D4F8969", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:premise:*:*:*", "matchCriteriaId": "5FA149E2-AF10-4D3A-9F6C-8AF74110DEF8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1.207:*:*:*:premise:*:*:*", "matchCriteriaId": "CC521F86-4E3F-4217-836D-235B1D9E8876", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.4.1.236:*:*:*:premise:*:*:*", "matchCriteriaId": "45AA1E4F-2B38-42A3-A99C-F7ED17067E00", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:avalanche:6.4.2:*:*:*:premise:*:*:*", "matchCriteriaId": "78794BF3-682E-4256-92DA-D669BF78A297", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS."}, {"lang": "es", "value": "Un error de uno en uno en WLInfoRailService en Ivanti Avalanche 6.3.1 permite que un atacante remoto no autenticado bloquee el servicio, lo que resulta en un DoS."}], "id": "CVE-2024-36136", "lastModified": "2024-08-15T17:31:15.880", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "support@hackerone.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-08-14T03:15:04.390", "references": [{"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-193"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-193"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.1:*:*:*:premise:*:*:* (string)

matchCriteriaId : 6060540C-A977-4E2A-8E1B-41CC3C3E92ED (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.1.1507:*:*:*:premise:*:*:* (string)

matchCriteriaId : 771C1447-6F5E-45DE-BDE6-8FFBB4708D67 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 778D9C09-12BB-47FC-B74B-DC114AE3A540 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:windows:*:* (string)

matchCriteriaId : 617DA85C-5FCE-4650-99AA-A1052E690B2C (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:premise:*:*:* (string)

matchCriteriaId : 44ABD265-3F8F-415A-96B3-16975661CDEB (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:*:*:*:* (string)

matchCriteriaId : CF93250C-0754-4B87-9BBE-DDF255EEB157 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:premise:*:*:* (string)

matchCriteriaId : 521CD0B6-8348-41D6-8AD8-79F884F4F10F (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 3162335B-9FA4-4AC3-85F0-BD34F859EDFB (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:premise:*:*:* (string)

matchCriteriaId : 03E7F6CA-8A72-4A3E-A281-2A7653162FB3 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:*:*:*:* (string)

matchCriteriaId : E2AB421E-C976-4CFF-93F9-40354CB579C5 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:premise:*:*:* (string)

matchCriteriaId : 4C581973-06B3-4E16-B37C-41FE7B4388CB (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:*:*:*:* (string)

matchCriteriaId : FE9E1AF8-A8ED-4E49-B25F-E27AD4B61E7D (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:premise:*:*:* (string)

matchCriteriaId : 3CC6AA75-22CD-4588-A1F9-574D7E7698CF (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.3.4.153:*:*:*:premise:*:*:* (string)

matchCriteriaId : F5A7D50A-DD35-40B6-B4AD-8703DB016E90 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.4.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 1196CC8F-4D46-4258-9997-1C7E9954A8D6 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:*:*:*:* (string)

matchCriteriaId : DF9D82B4-4AF6-4E14-AACE-56982D4F8969 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:premise:*:*:* (string)

matchCriteriaId : 5FA149E2-AF10-4D3A-9F6C-8AF74110DEF8 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.4.1.207:*:*:*:premise:*:*:* (string)

matchCriteriaId : CC521F86-4E3F-4217-836D-235B1D9E8876 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.4.1.236:*:*:*:premise:*:*:* (string)

matchCriteriaId : 45AA1E4F-2B38-42A3-A99C-F7ED17067E00 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:ivanti:avalanche:6.4.2:*:*:*:premise:*:*:* (string)

matchCriteriaId : 78794BF3-682E-4256-92DA-D669BF78A297 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS. (string)

}

1 : { »

lang : es (string)

value : Un error de uno en uno en WLInfoRailService en Ivanti Avalanche 6.3.1 permite que un atacante remoto no autenticado bloquee el servicio, lo que resulta en un DoS. (string)

}

]

id : CVE-2024-36136 (string)

lastModified : 2024-08-15T17:31:15.880 (string)

metrics : { »

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : support@hackerone.com (string)

type : Secondary (string)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-08-14T03:15:04.390 (string)

references : [ »

0 : { »

source : support@hackerone.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373 (string)

}

]

sourceIdentifier : support@hackerone.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-193 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-193 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object