VulnerabilityModified

CVE-2021-42133

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write.

HIGH 8.1EPSS 2.80%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.80%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS: 2.80% probability · 86th percentile
CISA KEV: Not listed
Weakness: CWE-434, CWE-829
Affected: ivanti/avalanche
Source: support@hackerone.com

References

https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3Vendor Advisory
https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.