Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-CVE-2025-8296-CVE-2025-8297?language=en_US | Vendor Advisory |
Configurations
History
15 Aug 2025, 18:23
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ivanti:avalanche:*:*:*:*:premise:*:*:* | |
| First Time |
Ivanti avalanche
Ivanti |
|
| References | () https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-CVE-2025-8296-CVE-2025-8297?language=en_US - Vendor Advisory |
12 Aug 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-12 15:15
Updated : 2025-08-15 18:23
NVD link : CVE-2025-8297
Mitre link : CVE-2025-8297
JSON object : View
Products Affected
ivanti
- avalanche
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type