漏洞描述
Ivanti Avalanche 6.3.2 is vulnerable to local file inclusion because it allows remote unauthenticated user to access files that reside outside the 'image' folder.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
ssd-disclosure.comhttps://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal/↗forums.ivanti.comhttps://forums.ivanti.com/s/article/Security-Alert-CVE-2021-30497-Directory-Traversal-Vulnerability?language=en_US↗help.ivanti.comhttps://help.ivanti.com/wl/help/en_us/aod/5.4/Avalanche/Console/Launching_the_Avalanche.htm↗cve.mitre.orghttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30497↗github.comhttps://github.com/StarCrossPortal/scalpel↗