CVE-2023-28126 — n/a / Avalanche

Description (CNA)

An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message.

Affected (CNA)

Vendor / product	Versions
n/a / Avalanche	affected Avalanche versions 6.3.x and below

CWE

CWE-305

References

https://forums.ivanti.com/s/article/ZDI-CAN-17750-Ivanti-Avalanche-EnterpriseServer-GetSettings-Exposed-Dangerous-Method-Authentication-Bypass-Vulnerability?language=en_US

ADP enrichment

CVE

No English description supplied.

https://forums.ivanti.com/s/article/ZDI-CAN-17750-Ivanti-Avalanche-EnterpriseServer-GetSettings-Exposed-Dangerous-Method-Authentication-Bypass-Vulnerability?language=en_US

CISA-ADP

No English description supplied.

No references supplied.