CVE-2022-36972
Published: 29 March 2023
Summary
CVE-2022-36972 is a critical-severity SQL Injection (CWE-89) vulnerability in Ivanti Avalanche. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-36972 is a SQL injection vulnerability in the ProfileDaoImpl class of Ivanti Avalanche version 6.3.2.3490. The flaw permits construction of SQL queries from attacker-supplied input, enabling authentication bypass on affected installations. It carries a CVSS 3.1 score of 9.8 and is tracked under CWE-89.
Remote, unauthenticated attackers can exploit the issue by submitting a crafted request that triggers the vulnerable code path, allowing them to bypass authentication controls and potentially gain full access to the system. The vulnerability was originally reported as ZDI-CAN-15328.
Public references point to the Ivanti Avalanche 6.3.4 release notes and the corresponding Zero Day Initiative advisory ZDI-22-777, which document the availability of a patched version that addresses the flaw. The EPSS score stands at 0.3091 with no material increase from its recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-39629
Vulnerability details
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can…
more
leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15328.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.