cbcvebase.
CVE-2022-36974
published 2023-03-29

CVE-2022-36974: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…

PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
84.45%
99.7th percentile
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Web File Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15330.

Affected

2 ranges
VendorProductVersion rangeFixed in
ivantiavalanche——
ivantiavalanche>= 6.3.2.3490 < 6.3.46.3.4

Detection & IOCsextracted from sources · hover to see the quote

  • →Target service for exploitation is the Web File Server service within Ivanti Avalanche; monitor for anomalous deserialization activity or unexpected process spawning from this service ↗
  • →Authentication bypass precedes exploitation; monitor for authentication anomalies or unexpected successful logins to Ivanti Avalanche Web File Server prior to deserialization attempts ↗
  • →Code execution occurs in the context of the service account; monitor for unusual child processes or lateral movement originating from the Ivanti Avalanche service account ↗
  • ·Vulnerability is confirmed on Ivanti Avalanche version 6.3.2.3490; detections and mitigations should be scoped to this version and potentially adjacent versions pending vendor advisory clarification ↗
  • ·The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) with a CVSS Base Score of 9.8 (CRITICAL); prioritize patching and detection accordingly ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.