First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-47009

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Ivanti	Avalanche	—
ivanti	avalanche	<= 6.4.2.313

References

https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-AdvisoryVendor Advisory

Timeline

Published: Oct 8, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-47019.9A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18 CVE-2024-470109.8Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.CVE-2024-470117.5Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information CVE-2024-470127.8In mm_GetMobileIdIndexForNsUpdate of mm_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. This could CVE-2024-470137.8In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local e CVE-2024-470148.8Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292.CVE-2024-470155.5In ProtocolMiscHwConfigChangeAdapter::GetData() of protocolmiscadapter.cpp, there is a possible out-of-bounds read due to a missing bounds c CVE-2024-470167.8there is a possible privilege escalation due to an insecure default value. This could lead to local escalation of privilege with no addition CVE-2024-470177.8In ufshc_scsi_cmd of ufs.c, there is a possible stack variable use after free due to a use after free. This could lead to local escalation o CVE-2024-470185.5In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible out of bounds read due to a buffer overflow. This could lead to local CVE-2024-470195.5In ProtocolEmbmsSaiListAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. Th CVE-2024-47025.4The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, an

CVE-2024-47009: Critical severity, CVSS 9.8 | Vulnix