A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service.
References
Link | Resource |
---|---|
https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3 | Vendor Advisory |
Configurations
History
08 Dec 2021, 19:00
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://forums.ivanti.com/s/article/Security-Alert-CVE-s-Addressed-in-Avalanche-6-3-3 - Vendor Advisory | |
CWE | CWE-502 | |
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
CPE | cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:* |
07 Dec 2021, 14:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-12-07 14:15
Updated : 2024-02-04 22:08
NVD link : CVE-2021-42127
Mitre link : CVE-2021-42127
CVE.ORG link : CVE-2021-42127
JSON object : View
Products Affected
ivanti
- avalanche
CWE
CWE-502
Deserialization of Untrusted Data