CVE-2022-36980
Race Condition in Ivanti Avalanche 6.3.2.3490 – 6.3.4
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2022-36980 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Ivanti Avalanche. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
This vulnerability is an authentication bypass flaw, tracked as CVE-2022-36980 and ZDI-CAN-15528, that affects Ivanti Avalanche version 6.3.2.3490. The issue resides in the EnterpriseServer service and stems from a race condition (CWE-367) caused by insufficient locking during authentication operations, allowing the existing authentication mechanism to be circumvented despite the requirement for initial credentials. It carries a CVSS 3.1 score of 8.1 with network attack vector and high impact on confidentiality, integrity, and availability.
Remote attackers can exploit the flaw without user interaction to bypass authentication entirely on affected installations. Successful exploitation grants the attacker the ability to perform unauthorized operations on the system as if valid credentials had been supplied.
The referenced advisories and release notes indicate that the issue is resolved in Avalanche 6.3.4. The EPSS score has remained flat at 0.1527 with no indicated rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-39637
Vulnerability Data
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EnterpriseServer service. The issue…
more
results from the lack of proper locking when performing operations during authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15528.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.2V17.2.6
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Timestamps meeting UTC or offset standards help identify TOCTOU issues through precise chronological reconstruction of check/use operations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.