Headline
CVE-2023-28128: Ivanti Community
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution.
Loading
×Sorry to interrupt
CSS Error
Refresh
Related news
Ivanti Avalanche FileStoreConfig Shell Upload
Ivanti Avalanche versions prior to 6.4.0.186 permits MS-DOS style short names in the configuration path for the Central FileStore. Because of this, an administrator can change the default path to the web root of the applications, upload a JSP file, and achieve remote command execution as NT AUTHORITY\SYSTEM.