CVE-2022-36981
Published: 29 March 2023
Summary
CVE-2022-36981 is a critical-severity Path Traversal (CWE-22) vulnerability in Ivanti Avalanche. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
This vulnerability is a path traversal flaw (CWE-22) in Ivanti Avalanche version 6.3.3.101. It resides in the DeviceLogResource class, where insufficient validation of a user-supplied path allows the path to be used in file operations. The issue permits remote code execution and carries a CVSS 3.1 score of 9.8.
Although the vulnerability description states that authentication is required, the existing mechanism can be bypassed, enabling an unauthenticated remote attacker to supply a crafted path and execute arbitrary code in the context of the Avalanche service account.
The referenced advisories and release notes indicate that the flaw is addressed in Avalanche 6.3.4. The EPSS score stands at 0.8809 with no indicated rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-39638
Vulnerability details
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DeviceLogResource class. The…
more
issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15966.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.