CVE-2024-13181: High Path Traversal in Ivanti Avalanche

CVE-2024-13181 is a high severity (CVSS 7.3) path traversal in Ivanti Avalanche before version 6.4.7. It allows a remote unauthenticated attacker to bypass authentication, and the record says it addresses incomplete fixes for CVE-2024-47010. Upgrade to 6.4.7 or later. Ivanti's advisory lists several fixes in that release.

What's affected

• Ivanti Avalanche versions before 6.4.7.
• The record states this CVE covers incomplete fixes from CVE-2024-47010.

Version 6.4.7 is the release named in the record and in the title of Ivanti's advisory. Confirm in the advisory.

How to check if you're exposed

Run the check below, or read the vendor or project notes linked in Sources.

# In the Avalanche management console, open the About or version page,
# and compare it to 6.4.7.

Compare the result to the affected range above.

What to do now

1. If you patched for CVE-2024-47010 earlier, do not assume you are done. Move to 6.4.7 or later.
2. Read the multi-CVE advisory and apply everything it lists.
3. Restrict network access to the management server.
4. Audit administrator accounts after the upgrade.
5. Look up CVE-2024-13181 on its Gold page to see the current details and any fix information.
6. Check your own dependency files with the free in-browser dependency scan. It runs in your browser and does not send the file to a server.

Why it matters

The interesting part of this record is the phrase about incomplete fixes. A first patch closed one route to the flaw and left another open, so the same weakness was assigned a second identifier. Path traversal bugs are a common victim of this, because filtering one pattern of dots and slashes is easy and covering every encoding is not.

For defenders the lesson is simple. A patched version number from a first advisory is not the same as a safe system if a follow-up advisory exists. Check the vendor's advisory list for the product, and treat a repeat CVE in the same area as a signal to review your exposure again.

The weaknesses are the same as the sibling CVE-2024-13179: path traversal and authentication bypass using an alternate path.

This CVE is a path traversal flaw that bypasses authentication (CWE-22, CWE-288, Path Traversal and Authentication Bypass Using an Alternate Path or Channel). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.

Path traversal lets a request wander outside the folder or route the developer intended. Used against an authentication layer, it reaches pages that should require a login without ever presenting credentials.

The fix is to normalize the path before applying access rules, and to apply the rules to the normalized value, so there is only one way to name each resource.

Quick check

Sources

• Ivanti security advisory

Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.

Last reviewed: 19 October 2026.