What is CVE-2022-36983?

CVE-2022-36983 is a critical-severity vulnerability in Ivanti Avalanche, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2023-03-29.

How severe is CVE-2022-36983?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Ivanti Avalanche

CVE-2022-36983

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetSettings class. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15919.

Vulnerability class: Broken Authentication

EPSS: 0.047 (90.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Ivanti Avalanche — versions 6.3.3.101

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

zdi-disclosures@trendmicro.com (Release Notes)
zdi-disclosures@trendmicro.com (VDB Entry, Third Party Advisory)

Frequently asked questions

What is CVE-2022-36983?: CVE-2022-36983 is a critical-severity vulnerability in Ivanti Avalanche, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2023-03-29.
How severe is CVE-2022-36983?: Critical severity. CVSS v3 base score is 9.8 out of 10.