Vulnerability · Published Aug 14, 2024 · Assigned by hackerone

CVE-2024-37399

High 7.5

In plain English

A high-severity null pointer dereference in Avalanche from Ivanti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 27.8% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)27.8%top 1.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.

Affected products (as reported)

Vendor	Product	Versions
Ivanti	Avalanche	6.4.4 – before 6.4.4

Weakness: CWE-476 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373