CVE-2023-28126

MEDIUM

Ivanti Avalanche < 6.3.4.153 - Authentication Bypass via SetUser Method or Race Condition

Title source: llm

Description

An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message.

References (1)

Core 1

Core References

Vendor Advisory

https://forums.ivanti.com/s/article/ZDI-CAN-17750-Ivanti-Avalanche-EnterpriseServer-GetSettings-Exposed-Dangerous-Method-Authentication-Bypass-Vulnerability?language=en_US

Scores

CVSS v3 5.9

EPSS 0.6666

EPSS Percentile 99.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-305 CWE-362

Status published

Products (1)

ivanti/avalanche < 6.3.4.153

Published May 09, 2023

Tracked Since Feb 18, 2026