CVE-2022-36972

—

CVSS 3.1

9.8 critical

EPSS

7%p93

Published

Mar 29, 2023 (Mar 29, 2023)

Modified

Jun 17, 2026

Description

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15328.

Vendors: ivanti
Products: avalanche
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (6.5%)

In the news0 stories

No ingested article mentions this CVE yet.