This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate Management Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15449.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-22-782/ | Third Party Advisory VDB Entry |
| https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt | Release Notes |
Configurations
History
06 Apr 2023, 15:03
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
06 Apr 2023, 13:29
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | (MISC) https://www.zerodayinitiative.com/advisories/ZDI-22-782/ - Third Party Advisory, VDB Entry | |
| References | (MISC) https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - Release Notes | |
| First Time |
Ivanti
Ivanti avalanche |
Information
Published : 2023-03-29 19:15
Updated : 2023-04-06 15:03
NVD link : CVE-2022-36977
Mitre link : CVE-2022-36977
JSON object : View
Products Affected
ivanti
- avalanche
CWE
CWE-502
Deserialization of Untrusted Data