Wiz
Vulnerability DatabaseCVE-2022-36972

CVE-2022-36972: 
Ivanti Avalanche vulnerability analysis and mitigation

Overview

This vulnerability (CVE-2022-36972) affects Ivanti Avalanche version 6.3.2.3490 and allows remote attackers to bypass authentication. The vulnerability was discovered in the ProfileDaoImpl class and was publicly disclosed on March 29, 2023. The issue was initially reported to the vendor on October 22, 2021, and was tracked as ZDI-CAN-15328 (Zero Day Initiative).

Technical details

The vulnerability exists within the ProfileDaoImpl class of Ivanti Avalanche. The specific flaw involves the execution of SQL queries composed from user-supplied strings, leading to SQL injection. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

Impact

An attacker can leverage this vulnerability to bypass authentication on the system, potentially gaining unauthorized access to sensitive information and system controls (Zero Day Initiative).

Mitigation and workarounds

Ivanti has addressed this vulnerability in Avalanche version 6.3.4. Users are advised to upgrade to this version to protect against potential exploitation (Release Notes).

Additional resources

Source: This report was generated using AI

Related Ivanti Avalanche vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2023-38036CRITICAL9.8
  • Ivanti AvalancheIvanti Avalanche
  • cpe:2.3:a:ivanti:avalanche
NoYesJul 12, 2025
CVE-2024-13181CRITICAL9.8
  • Ivanti AvalancheIvanti Avalanche
  • cpe:2.3:a:ivanti:avalanche
NoYesJan 14, 2025
CVE-2024-13180HIGH7.5
  • Ivanti AvalancheIvanti Avalanche
  • cpe:2.3:a:ivanti:avalanche
NoYesJan 14, 2025
CVE-2025-8297HIGH7.2
  • Ivanti AvalancheIvanti Avalanche
  • cpe:2.3:a:ivanti:avalanche
NoYesAug 12, 2025
CVE-2025-8296HIGH7.2
  • Ivanti AvalancheIvanti Avalanche
  • cpe:2.3:a:ivanti:avalanche
NoYesAug 12, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo