Skip to content
fr Sign in
9.8 Critical

CVE-2022-36971 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche…

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the JwtTokenUtility class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15301.

Affected products and versions

Product Affected versions Fixed in
Avalanche 6.3.2.3490 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Avalanche

The 93 CVEs of Avalanche →
CVE-2025-8297 Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated… 7.2 High CVE-2025-8296 SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges… 7.2 High CVE-2023-38036 A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to… 9.8 Critical CVE-2024-13181 Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass… 7.3 High
Track this CVE