cbcvebase.
CVE-2022-36978
published 2023-03-29

CVE-2022-36978: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…

PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
7.33%
93.6th percentile
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Notification Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15448.

Affected

2 ranges
VendorProductVersion rangeFixed in
ivantiavalanche——
ivantiavalanche>= 6.3.2.3490 < 6.3.46.3.4

Detection & IOCsextracted from sources · hover to see the quote

  • →Target service for exploitation is the Notification Server service within Ivanti Avalanche; monitor for anomalous deserialization activity or unexpected process spawning from this service ↗
  • →The authentication mechanism can be bypassed prior to exploitation; monitor for unauthenticated or anomalous authentication attempts against Ivanti Avalanche endpoints preceding deserialization payloads ↗
  • →Code execution occurs in the context of the service account; monitor for privilege escalation or lateral movement originating from the Avalanche Notification Server service account ↗
  • ·Vulnerability is confirmed on Ivanti Avalanche version 6.3.2.3490; scope of affected versions beyond this specific build is not detailed in the available sources ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.