7.5
Élevée
CVE-2022-36983 This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche
Description
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetSettings class. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15919.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Avalanche | 6.3.3.101 | Pas de correctif indiqué |
Références
- download.wavelink.com download.wavelink.com
- www.zerodayinitiative.com www.zerodayinitiative.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Avalanche
Les 93 CVE de Avalanche →
CVE-2025-8297
Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated…
7.2
Élevée
CVE-2025-8296
SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges…
7.2
Élevée
CVE-2023-38036
A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to…
9.8
Critique
CVE-2024-13181
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass…
7.3
Élevée