CVE-2024-13179 is a high severity (CVSS 7.3) path traversal in Ivanti Avalanche before version 6.4.7 that lets a remote unauthenticated attacker bypass authentication. Ivanti's advisory covers several CVEs in the 6.4.7 release. Upgrade to 6.4.7 or later and keep the server off the public internet.
What's affected
- Ivanti Avalanche versions before 6.4.7.
Ivanti's advisory is titled for Avalanche 6.4.7, and the record says versions before 6.4.7 are affected. Confirm details in the advisory.
How to check if you're exposed
Run the check below, or read the vendor or project notes linked in Sources.
# In the Avalanche management console, open the About or version page,
# and compare it to 6.4.7.
Compare the result to the affected range above.
What to do now
- Check your Avalanche version in the console and upgrade to 6.4.7 or later.
- Read the multi-CVE advisory, since the same release fixes several other issues.
- Keep the Avalanche server off the open internet, and expose only the ports devices need.
- Review administrator accounts and recent logins after you upgrade.
- Look up CVE-2024-13179 on its Gold page to see the current details and any fix information.
- Check your own dependency files with the free in-browser dependency scan. It runs in your browser and does not send the file to a server.
Why it matters
The record lists two weakness classes: path traversal (CWE-22) and authentication bypass using an alternate path (CWE-288). A traversal bug in a request path can let a caller reach something that was meant to sit behind a login, so the login check is skipped rather than defeated.
Avalanche is a mobile device management product, which means it holds inventory and control over many handheld and mobile devices. That raises the stakes for any authentication bypass. The vector shows low impact in each area, but access to a management plane is worth more than the numbers suggest, so patch it promptly.
Ivanti also lists a related issue, CVE-2024-13181, which addresses an incomplete fix for an earlier CVE. Upgrading to 6.4.7 covers both.
This CVE is a path traversal flaw that bypasses authentication (CWE-22, CWE-288, Path Traversal and Authentication Bypass Using an Alternate Path or Channel). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Path traversal lets a request wander outside the folder or route the developer intended. Used against an authentication layer, it reaches pages that should require a login without ever presenting credentials.
The fix is to normalize the path before applying access rules, and to apply the rules to the normalized value, so there is only one way to name each resource.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
Ivanti Avalanche 6.4.7, per the record and the advisory title.
Is it on the CISA KEV list?
The record says no.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
