Full title: Ivanti Avalanche FileStoreConfig Shell Upload Exploit 
Category: web applications
Platform: multiple
Ivanti Avalanche versions prior to 6.4.0.186 permits MS-DOS style short names in the configuration path for the Central FileStore. Because of this, an administrator can change the default path to the web root of the applications, upload a JSP file, and achieve remote command execution as NT AUTHORITY\SYSTEM.

# 0day.today @ http://0day.today/