CVE-2024-13180

CVE-2024-13180 is a path traversal (CWE-22) flaw in Ivanti Avalanche, Ivanti's on-premises wireless device management platform, affecting all versions before 6.4.7. A remote, unauthenticated attacker can send crafted requests containing traversal sequences to the Avalanche web interface to read files outside the intended directory, gaining access to sensitive information such as configuration data or stored credentials (confidentiality-only impact, no user interaction or privileges required). The flaw affects any organization running an unpatched Avalanche server, and it is a follow-up advisory because the original fix for CVE-2024-47011 was incomplete. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the CVE is not yet in CISA KEV, but the 27.8% EPSS score (98th percentile) indicates an elevated likelihood of exploitation within 30 days.

What to do: Upgrade Ivanti Avalanche to version 6.4.7 or later, which supersedes the incomplete fix for CVE-2024-47011, so sites that already applied that earlier patch must still verify they have reached 6.4.7. Until patched, restrict the Avalanche web interface to trusted management networks and review web logs for traversal-pattern requests or unexpected file reads. Note this is an information-disclosure flaw, so also check whether configuration files or credentials could have been exposed on internet-facing instances.