PT-2022-23727 · Ivanti · Ivanti Avalanche

Chudypb + 1 · Published 2022-05-26 · Updated 2023-04-28 · CVE-2022-36983

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions 6.3.3.101

Description This issue allows remote attackers to bypass authentication on affected installations. The specific flaw exists within the SetSettings class, resulting from the lack of authentication prior to allowing access to functionality. An attacker can leverage this to bypass authentication on the system.

Recommendations For Ivanti Avalanche version 6.3.3.101, consider disabling the SetSettings class until a patch is available to prevent exploitation. Restrict access to the affected functionality to minimize the risk of authentication bypass.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-36983

ZDI-22-788

Affected Products

Ivanti Avalanche

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-36983 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-788 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36983 · Vendor Advisory
• https://t.me/cibsecurity/61077 · Telegram Post
• https://t.me/cvenotify/49367 · Telegram Post
• https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt · Note