An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by registering to receive messages from the server and perform an authentication bypass.
References
Configurations
History
29 Jan 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://forums.ivanti.com/s/article/ZDI-CAN-17729-CVE-2023-28125-Bug-958437-ZDI-CAN-17729-Ivanti-Avalanche-InfoRail-Authentication-Bypass-Vulnerability?language=en_US - Vendor Advisory |
16 May 2023, 18:41
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ivanti:avalanche:*:*:*:*:premise:*:*:* | |
| References | (MISC) https://forums.ivanti.com/s/article/ZDI-CAN-17729-CVE-2023-28125-Bug-958437-ZDI-CAN-17729-Ivanti-Avalanche-InfoRail-Authentication-Bypass-Vulnerability?language=en_US - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.9 |
| First Time |
Ivanti
Ivanti avalanche |
|
| CWE | CWE-362 |
09 May 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-09 22:15
Updated : 2025-01-29 15:15
NVD link : CVE-2023-28125
Mitre link : CVE-2023-28125
JSON object : View
Products Affected
ivanti
- avalanche
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')