Cyber Resilience

CVE-2022-36979

Critical

Published: 29 March 2023

Published
29 March 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.3091 96.9th percentile
Risk Priority 38 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-36979 is a critical-severity SQL Injection (CWE-89) vulnerability in Ivanti Avalanche. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 3.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

This vulnerability is an authentication bypass issue affecting Ivanti Avalanche version 6.3.2.3490. It stems from a flaw in the AvalancheDaoSupport class that permits a crafted request to execute SQL queries built from attacker-supplied input, corresponding to CWE-89. Although the attack requires some form of authentication, the existing mechanism can be circumvented entirely, resulting in a CVSS 3.1 score of 9.8.

Remote attackers can exploit the flaw over the network without user interaction to bypass authentication controls and obtain full access to the system, including the ability to read, modify, or delete data and potentially take over affected installations. The issue was originally reported as ZDI-CAN-15493.

Vendor release notes for Avalanche 6.3.4 and the corresponding Zero Day Initiative advisory ZDI-22-784 address remediation, indicating that upgrading to the patched version resolves the SQL composition weakness. The EPSS score has remained stable at its peak value of 0.3091 with no indicated rise after disclosure.

EU & UK References

Vulnerability details

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AvalancheDaoSupport class. A crafted…

more

request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15493.

CWE(s)
CWE-89

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ivanti
avalanche
6.3.2.3490 — 6.3.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References