VulnerabilityModified

CVE-2021-42125

An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files.

HIGH 8.8EPSS 81.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 81.6%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 81.60% probability · 100th percentile
CISA KEV: Not listed
Weakness: CWE-502, CWE-434
Affected: ivanti/avalanche
Source: support@hackerone.com

References

https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3Vendor Advisory
https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.